ledge-server 0.1.1 → 0.1.3

package/lib/serve.js

@@ -1,7 +1,7 @@
 // @bun
 // src/bun/cli.ts
 import { homedir as homedir5 } from "os";
-import { join as join10, relative as relative3, resolve as resolve8, sep as sep4 } from "path";
+import { join as join12, relative as relative3, resolve as resolve8, sep as sep4 } from "path";
 
 // src/bun/mcp.ts
 var PROTOCOL_VERSIONS = new Set(["2024-11-05", "2025-03-26", "2025-06-18"]);
@@ -3848,6 +3848,7 @@ var ledgeTools = [
 // src/bun/cliShim.ts
 import { homedir as homedir4 } from "os";
 import { join as join8, resolve as resolve6 } from "path";
+var SERVE_ENTRY = join8(import.meta.dir, "serve.js");
 function tildify(p, home = homedir4()) {
   const h = resolve6(home);
   const r = resolve6(p);
@@ -3856,10 +3857,98 @@ function tildify(p, home = homedir4()) {
   return r.startsWith(h + "/") ? `~${r.slice(h.length)}` : p;
 }
 
+// src/bun/linuxApp.ts
+import { existsSync, readdirSync, readFileSync } from "fs";
+import { dirname as dirname4, join as join9 } from "path";
+function launcherBeside(execPath) {
+  const launcher = join9(dirname4(execPath), "launcher");
+  return existsSync(launcher) ? launcher : null;
+}
+function launcherRunning(launcher, procDir = "/proc") {
+  let entries;
+  try {
+    entries = readdirSync(procDir);
+  } catch {
+    return false;
+  }
+  for (const entry of entries) {
+    if (!/^\d+$/.test(entry))
+      continue;
+    let cmdline;
+    try {
+      cmdline = readFileSync(join9(procDir, entry, "cmdline"), "utf8");
+    } catch {
+      continue;
+    }
+    if (cmdline.split("\x00")[0] === launcher)
+      return true;
+  }
+  return false;
+}
+function openLinuxApp(execPath = process.execPath) {
+  const launcher = launcherBeside(execPath);
+  if (!launcher)
+    return false;
+  if (launcherRunning(launcher))
+    return true;
+  try {
+    Bun.spawn({ cmd: [launcher], detached: true, stdio: ["ignore", "ignore", "ignore"] }).unref();
+  } catch {
+    return false;
+  }
+  return true;
+}
+
+// src/bun/wslApp.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname5, join as join10 } from "path";
+var WINDOWS_APP_FILE = ".windows-app.json";
+function inWsl(env = process.env) {
+  return process.platform === "linux" && !!env["WSL_DISTRO_NAME"] && !!env["WSL_INTEROP"];
+}
+function readWindowsApp(appHome) {
+  try {
+    const v = JSON.parse(readFileSync2(join10(appHome, WINDOWS_APP_FILE), "utf8"));
+    if (typeof v.launcher !== "string" || !/^[A-Za-z]:\\/.test(v.launcher))
+      return null;
+    if (typeof v.pid !== "number" || !Number.isInteger(v.pid) || v.pid <= 0)
+      return null;
+    return { launcher: v.launcher, pid: v.pid };
+  } catch {
+    return null;
+  }
+}
+function tasklistShowsBun(out) {
+  return /^"bun\.exe","\d+"/im.test(out);
+}
+async function output(cmd) {
+  const proc = Bun.spawn({ cmd, stdin: "ignore", stdout: "pipe", stderr: "ignore" });
+  const out = await new Response(proc.stdout).text();
+  return { code: await proc.exited, out };
+}
+async function openWindowsApp(appHome) {
+  const app = readWindowsApp(appHome);
+  if (!app)
+    return false;
+  try {
+    const running = await output(["tasklist.exe", "/FI", `PID eq ${app.pid}`, "/FI", "IMAGENAME eq bun.exe", "/FO", "CSV", "/NH"]);
+    if (tasklistShowsBun(running.out))
+      return true;
+    const path = await output(["wslpath", "-u", app.launcher]);
+    const launcher = path.out.trim();
+    if (path.code !== 0 || !launcher)
+      return false;
+    Bun.spawn({ cmd: [launcher], cwd: dirname5(launcher), detached: true, stdio: ["ignore", "ignore", "ignore"] }).unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // src/bun/openRequest.ts
-import { join as join9, resolve as resolve7 } from "path";
+import { join as join11, resolve as resolve7 } from "path";
 import { readFile as readFile7, rename as rename6, unlink as unlink5, writeFile as writeFile6 } from "fs/promises";
-var OPEN_REQUEST_PATH = join9(APP_HOME, ".open-request.json");
+var OPEN_REQUEST_PATH = join11(APP_HOME, ".open-request.json");
 var OPEN_REQUEST_MAX_AGE_MS = 60000;
 async function writeOpenRequest(path) {
   await ensureAppHome();
@@ -4053,7 +4142,10 @@ function targetArgs(arg, cwd, scope, folder) {
 async function openApp(io) {
   if (await io.openApp())
     return 0;
-  io.err(`ledge: could not open the app (bundle ${BUNDLE_ID}) \u2014 is Ledge installed? (macOS only)`);
+  if (inWsl())
+    io.err("ledge: could not open the app. Start Ledge on Windows once, so WSL knows where it is installed.");
+  else
+    io.err("ledge: could not open the app. Is this the `ledge` the app installed? (Install Shell Command)");
   return 1;
 }
 function humanize(msg) {
@@ -4097,7 +4189,7 @@ async function runCli(argv, io) {
             return 0;
           }
           if (notes.length === 0) {
-            io.err(ws !== null ? `no notes in ${tildify(folder === "" ? ws : join10(ws, folder))}` : "no notes");
+            io.err(ws !== null ? `no notes in ${tildify(folder === "" ? ws : join12(ws, folder))}` : "no notes");
             return 0;
           }
           for (const line of formatNoteList(notes))
@@ -4148,7 +4240,7 @@ async function runCli(argv, io) {
               return 0;
             }
             if (res.tags.length === 0) {
-              io.err(ws !== null ? `no tags in ${tildify(folder === "" ? ws : join10(ws, folder))}` : "no tags");
+              io.err(ws !== null ? `no tags in ${tildify(folder === "" ? ws : join12(ws, folder))}` : "no tags");
               return 0;
             }
             const width = res.tags.reduce((w, t) => Math.max(w, t.tag.length + 1), 0);
@@ -4281,6 +4373,10 @@ function processIo() {
     stdin: async () => process.stdin.isTTY ? null : await Bun.stdin.text(),
     cwd: () => process.cwd(),
     openApp: async () => {
+      if (inWsl())
+        return await openWindowsApp(APP_HOME) || openLinuxApp();
+      if (process.platform === "linux")
+        return openLinuxApp();
       if (process.platform !== "darwin")
         return false;
       const proc = Bun.spawn({ cmd: ["open", "-b", BUNDLE_ID], stdout: "ignore", stderr: "ignore" });
@@ -4290,8 +4386,8 @@ function processIo() {
 }
 
 // src/bun/daemon.ts
-import { chmodSync, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync2, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
-import { join as join16 } from "path";
+import { chmodSync, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync4, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
+import { join as join19 } from "path";
 
 // src/bun/server.ts
 import { watch as watch2 } from "fs";
@@ -4300,9 +4396,9 @@ import { basename as basename8, resolve as resolve10 } from "path";
 
 // src/bun/pty.ts
 import { dlopen, ptr, CString, cc } from "bun:ffi";
-import { existsSync, writeFileSync } from "fs";
+import { existsSync as existsSync2, writeFileSync } from "fs";
 import { tmpdir } from "os";
-import { dirname as dirname4, join as join11 } from "path";
+import { dirname as dirname6, join as join13 } from "path";
 
 // src/bun/ptyNative.ts
 function nativeLibName(platform) {
@@ -4431,10 +4527,10 @@ function reap(pid) {
 }
 function libCandidates() {
   return [
-    join11(import.meta.dir, NATIVE_LIB),
-    join11(import.meta.dir, "native", NATIVE_DIR, NATIVE_LIB),
-    join11(import.meta.dir, "..", "..", "dist-native", NATIVE_LIB),
-    join11(dirname4(process.execPath), NATIVE_LIB)
+    join13(import.meta.dir, NATIVE_LIB),
+    join13(import.meta.dir, "native", NATIVE_DIR, NATIVE_LIB),
+    join13(import.meta.dir, "..", "..", "dist-native", NATIVE_LIB),
+    join13(dirname6(process.execPath), NATIVE_LIB)
   ];
 }
 var native;
@@ -4447,7 +4543,7 @@ function loadNative() {
     setNonblock: (fd) => symbols.ledge_set_nonblock(fd)
   });
   for (const lib of libCandidates()) {
-    if (!existsSync(lib))
+    if (!existsSync2(lib))
       continue;
     try {
       native = wrap(dlopen(lib, NATIVE_SYMBOLS).symbols);
@@ -4457,7 +4553,7 @@ function loadNative() {
     }
   }
   try {
-    const src = join11(tmpdir(), "ledge-pty.c");
+    const src = join13(tmpdir(), "ledge-pty.c");
     writeFileSync(src, NATIVE_C);
     native = wrap(cc({ source: src, symbols: NATIVE_SYMBOLS }).symbols);
   } catch (err) {
@@ -4966,9 +5062,12 @@ class InlinePool {
               slot.preambleLen = 0;
               slot.echo = "";
             }
-            emit(ev, slot.client);
-            if (ev.type === "ended")
+            if (ev.type === "ended") {
+              emit(this.endedEvent(slot, ev.blockId, ev.exitCode), slot.client);
               this.runEnded(session, slot, ev.blockId);
+            } else {
+              emit(ev, slot.client);
+            }
           }
         }
         if (slot.activeRun !== null && !slot.began && !slot.spoke && this.now() - slot.startedAt >= SILENT_MS) {
@@ -4977,7 +5076,7 @@ class InlinePool {
         }
         if (slot.abandoned && slot.activeRun !== null) {
           this.flushPreamble(slot, emit);
-          emit({ type: "ended", blockId: slot.activeRun, exitCode: null }, slot.client);
+          emit(this.endedEvent(slot, slot.activeRun, null), slot.client);
           this.dropSlot(session, slot);
           continue;
         }
@@ -4986,7 +5085,7 @@ class InlinePool {
           if (open && !slot.began)
             this.flushPreamble(slot, emit);
           if (open)
-            emit({ type: "ended", blockId: open, exitCode: null }, slot.client);
+            emit(this.endedEvent(slot, open, null), slot.client);
           this.dropSlot(session, slot);
         }
       }
@@ -5010,7 +5109,7 @@ class InlinePool {
       for (const slot of this.slots(session)) {
         const open = slot.parser.openBlockId ?? slot.activeRun;
         if (open)
-          emit({ type: "ended", blockId: open, exitCode: null }, slot.client);
+          emit(this.endedEvent(slot, open, null), slot.client);
         slot.shell.close();
       }
       this.sessions.delete(sessionId);
@@ -5122,6 +5221,9 @@ class InlinePool {
         return slot;
     return session.overflow.get(id);
   }
+  endedEvent(slot, blockId, exitCode) {
+    return { type: "ended", blockId, exitCode, durationMs: this.now() - slot.startedAt };
+  }
   runEnded(session, slot, id) {
     if (slot.activeRun === id)
       slot.activeRun = null;
@@ -5168,7 +5270,7 @@ function takePaste(t, now) {
 }
 
 // src/bun/profiles.ts
-import { join as join12 } from "path";
+import { join as join14 } from "path";
 import { mkdir as mkdir4, readFile as readFile8, rename as rename7, unlink as unlink6, writeFile as writeFile7 } from "fs/promises";
 function assertProfileName(name) {
   if (!isProfileName(name))
@@ -5188,7 +5290,7 @@ function seedText(name) {
 async function ensureProfileFile(name) {
   assertProfileName(name);
   await mkdir4(PROFILES_DIR, { recursive: true, mode: 448 });
-  const path = join12(PROFILES_DIR, `${name}.env`);
+  const path = join14(PROFILES_DIR, `${name}.env`);
   await writeFile7(path, seedText(name), { encoding: "utf8", flag: "wx", mode: 384 }).catch(() => {});
   return path;
 }
@@ -5198,8 +5300,8 @@ async function readProfile(name) {
 async function writeProfile(name, text) {
   assertProfileName(name);
   await mkdir4(PROFILES_DIR, { recursive: true, mode: 448 });
-  const path = join12(PROFILES_DIR, `${name}.env`);
-  const tmp = join12(PROFILES_DIR, `.${name}.env.tmp-${process.pid}`);
+  const path = join14(PROFILES_DIR, `${name}.env`);
+  const tmp = join14(PROFILES_DIR, `.${name}.env.tmp-${process.pid}`);
   try {
     await writeFile7(tmp, text, { encoding: "utf8", mode: 384 });
     await rename7(tmp, path);
@@ -5218,7 +5320,7 @@ var WELCOME_DOC = [
   "",
   "## Run a block",
   "",
-  "\u2318\u21A9 inside the block below, or the Run button on it (a tap, on a phone), runs it.",
+  "\u2318\u21A9 inside the block below (Ctrl+Enter on Linux), or the Run button on it (a tap, on a phone), runs it.",
   "",
   "```sh",
   "curl -s https://api.github.com/zen",
@@ -5261,7 +5363,7 @@ var WELCOME_DOC = [
 `);
 
 // src/bun/docs.ts
-import { basename as basename6, join as join13, resolve as resolve9 } from "path";
+import { basename as basename6, join as join15, resolve as resolve9 } from "path";
 import { mkdir as mkdir5, readdir as readdir4, readFile as readFile9, rename as rename8, unlink as unlink7, writeFile as writeFile8 } from "fs/promises";
 
 // docs/user/01-getting-started.md
@@ -5269,7 +5371,7 @@ var _01_getting_started_default = `# Getting Started
 
 Ledge is the notebook for developers and DevOps. It runs code and commands straight from your Markdown.
 
-The manual is read-only and its code blocks do not run. The note called Welcome to Ledge is where the same examples do run. Ledge creates it the first time it starts on a machine, whether that is your Mac or a new server, and it stays in the Scratch workspace until you delete it.
+The manual is read-only and its code blocks do not run. The note called Welcome to Ledge is where the same examples do run. Ledge creates it the first time it starts on a machine, whether that is your own computer or a new server, and it stays in the Scratch workspace until you delete it.
 
 ## Your first note
 
@@ -5342,16 +5444,51 @@ Notes are ordinary \`.md\` files in ordinary folders, so git, agents, and shell
 - **Remote hosts.** A \`host:\` line sends a note's blocks over ssh to another machine while the note stays here. See [[Run Code on Remote Hosts]].
 - **Remote servers.** Keep your notes on a server and use this app as the window onto it: the server holds the notes and runs the shells, over ssh. See [[Keep Notes on a Remote Server]].
 - **Your phone.** The same app on an iPhone or iPad, reading and running the notes on that server. See [[Ledge on Your Phone]].
-- **Appearance.** Ledge follows your Mac's light or dark setting. To pin one instead, set \`appearance.theme\` to \`"light"\` or \`"dark"\` under This app in Settings (\u2318,) and relaunch.
+- **Appearance.** Ledge follows the system's light or dark setting. To pin one instead, set \`appearance.theme\` to \`"light"\` or \`"dark"\` under This app in Settings (\u2318,) and relaunch.
 - **Fonts.** \`editor.fontSize\` sizes note text and \`terminal.fontSize\` sizes the terminal, both under This app in Settings (\u2318,). Relaunch to apply.
 
+## Ledge on Linux
+
+The Linux app is the same app. The keys in this manual are the keys of the desktop you are reading it on: a Mac reads Command chords, and Linux and Windows read the same chords with Ctrl and Alt.
+
+| On Linux | What differs |
+| --- | --- |
+| Tabs | Alt+1 to Alt+9 jumps to a tab, because Ctrl+1 to Ctrl+9 is the workspace jump. |
+| The terminal drawer | Every plain Ctrl chord goes to the shell, so Ctrl+C still interrupts a program. Ctrl+Shift+C copies, Ctrl+Shift+V pastes, and Ctrl+Shift+P still opens the palette from the terminal. |
+| Menus | There is no menu bar. Every menu item this manual names is in the command palette (Ctrl+Shift+P), and Quit Ledge is Ctrl+Q. |
+| Two chords GNOME keeps | Ubuntu's desktop takes Ctrl+Alt+T and Ctrl+Alt+L before any app sees them, so Toggle Tags and Toggle Backlinks run from the palette there. |
+| Passwords | Kept in the desktop's keyring through \`secret-tool\`, which the \`libsecret-tools\` package provides ([[Keep Notes on a Remote Server]]). |
+| Spelling | Enchant's dictionaries, the ones WebKitGTK underlines with, through the \`enchant-2\` command ([[Notes and Workspaces]]). |
+| Files | The app lives under \`~/.local/share/sh.ledge.app\`. Notes, settings, and the log stay under \`~/.ledge\`, as on a Mac. |
+
+## Ledge on Windows
+
+The Windows app is the same app, and its keys are Linux's: the chords in this manual with Ctrl and Alt, Alt+1 to Alt+9 for tabs, no menu bar, and Quit Ledge on Ctrl+Q.
+
+Your notes and your code live in WSL, the Windows Subsystem for Linux. The app is a window onto a Ledge server in your default Linux distribution, and every block runs in that distribution's shell, as a Linux command.
+
+Ledge needs WSL with a Linux distribution in it before it can finish installing. When either is missing, Ledge says so and quits. To install both, open PowerShell as administrator, run \`wsl --install\`, restart Windows, and create the Linux account Ubuntu asks for. Then open Ledge again.
+
+Each time it starts, Ledge checks the server in WSL and installs its own version there when that one is missing or different, which is what happens on the first launch and on the first launch after an update. A notice says "Setting up Ledge's server in WSL", and the window opens when it is done.
+
+| On Windows | What differs |
+| --- | --- |
+| Paths | Everything a note names is a Linux path. \`~\` is your Linux home, and \`cwd: /mnt/c/Users/you/project\` reaches a folder on the C: drive. |
+| Where to keep notes | In your Linux home, which File Explorer shows under Linux. WSL reports no file changes under \`/mnt\`, so a workspace there does not follow edits other programs make, a \`git pull\` included. |
+| Choose Folder\u2026 | Opens in your Linux home. A folder picked on a Windows drive attaches by its \`/mnt\` path, and one WSL does not mount is refused. |
+| The CLI | \`ledge\` is already on the PATH of a new WSL terminal, and Install Shell Command (ledge) is not offered. \`ledge <title>\` in WSL opens the Windows app ([[The ledge CLI]]). |
+| Passwords | Kept in Windows Credential Manager, under Windows Credentials ([[Keep Notes on a Remote Server]]). |
+| Spelling | Windows' own spell checker, in the language Windows is set to ([[Notes and Workspaces]]). |
+| Your phone | The server in WSL serves this computer only. To read notes on your phone, keep them on a separate server ([[Ledge on Your Phone]]). |
+| Files | The app lives under \`%LOCALAPPDATA%\\sh.ledge.app\`, and Settings > Apps lists it for uninstalling. Notes and the server's settings are under \`~/.ledge\` in WSL, and profiles under \`~/.config/ledge/profiles\` there. The app's settings and its log are in \`.ledge\` in your Windows user folder. |
+
 ## Updating Ledge
 
 Ledge checks for a newer version when it starts and once a day after that, and downloads one in the background when it finds one.
 
-When the download finishes, a notice says so and the Ledge menu shows Restart to Install Update. Choosing it quits Ledge and reopens the new version. Notes are already saved. A block that is still running keeps running on the old server, and the new version waits for it to finish before it swaps the server for its own, so the output arrives in the new window.
+When the download finishes, a notice says so and Restart to Install Update appears in the Ledge menu (in the command palette, on Linux and Windows). Choosing it quits Ledge and reopens the new version. Notes are already saved. A block that is still running keeps running on the old server, and the new version waits for it to finish before it swaps the server for its own, so the output arrives in the new window.
 
-Ledge > Check for Updates\u2026 checks now and tells you the result.
+Ledge > Check for Updates\u2026 (Check for Updates\u2026 in the palette, on Linux and Windows) checks now and tells you the result.
 
 To check only when you ask, set \`updates.automatic\` to \`false\` under This app in Settings (\u2318,) and relaunch. Ledge then makes no request at launch or during the day, and Check for Updates\u2026 still checks and downloads.
 
@@ -5359,15 +5496,18 @@ The check is a request to \`ledge.sh\` for the newest version's details. It carr
 
 ## When something goes wrong
 
-Ledge writes a log of each session, and Help > Reveal Log in Finder opens the folder it is in.
+Ledge writes a log of each session, and Help > Reveal Log in Finder (Reveal Log in File Manager, on Linux and Windows) opens the folder it is in.
 
-Two files sit there.
-\`ledge.log\` is the session running now.
+Four files sit there.
+\`ledge.log\` is the app's session running now.
 \`ledge.previous.log\` is the one before it, which is the file you want after a crash: relaunching Ledge starts a new log, and this is where the old one went.
+\`ledge-server.log\` and \`ledge-server.previous.log\` are the same pair for the server that holds your notes and runs your blocks.
+
+On Windows the server's pair is in WSL, in \`~/.ledge/logs\`, and the folder Reveal Log opens holds the app's pair.
 
-Both are plain text. Attach them to a bug report.
+All four are plain text. Attach them to a bug report.
 
-The manual ends with six tutorials that combine these into working routines: [[Tutorial: Run a Project from a Note]], [[Tutorial: A Daily Workflow]], [[Tutorial: Pair with an Agent]], [[Tutorial: Keep Notes Synced]], [[Tutorial: Set Up a Ledge Server]], and [[Tutorial: Back Up Your Notes to S3]].
+The manual ends with seven tutorials that combine these into working routines: [[Tutorial: Run a Project from a Note]], [[Tutorial: A Daily Workflow]], [[Tutorial: Pair with an Agent]], [[Tutorial: Keep Notes Synced]], [[Tutorial: Set Up a Ledge Server]], [[Tutorial: Back Up Your Notes to S3]], and [[Tutorial: Share Notes with a Git Clone]].
 `;
 
 // docs/user/02-running-code.md
@@ -5604,7 +5744,7 @@ A removed attached folder is never in the trash, because Ledge did nothing to it
 
 The last workspace in the strip cannot be deleted or removed.
 
-To move an attached workspace's folder somewhere else on disk, remove it from Ledge, move the folder in Finder, and attach it again at its new place. Everything travels with the folder: the notes, the images, and the trash. A managed folder can leave \`~/.ledge\` the same way: move it out in Finder (\u21E7\u2318G opens a hidden folder), attach it at its new place, then delete the empty workspace Ledge makes in the old one's place.
+To move an attached workspace's folder somewhere else on disk, remove it from Ledge, move the folder in Finder or your file manager, and attach it again at its new place. Everything travels with the folder: the notes, the images, and the trash. A managed folder can leave \`~/.ledge\` the same way: move it out (\`~/.ledge\` is hidden: Finder's Go to Folder\u2026 reaches it, and so does Ctrl+L in GNOME Files; on Windows it is in WSL, under Linux in File Explorer), attach it at its new place, then delete the empty workspace Ledge makes in the old one's place.
 
 ## Share a workspace with others
 
@@ -5724,13 +5864,13 @@ The sidebar answers a right-click too. On a row you get that row's menu, and on
 
 ## Spell checking
 
-Ledge underlines misspelled words in a note with a red squiggle, using your Mac's spelling dictionary and its languages.
+Ledge underlines misspelled words in a note with a red squiggle, using the system's spelling dictionary and its languages. On Linux that is Enchant, the checker WebKitGTK underlines with, and the right-click menu's suggestions need its \`enchant-2\` command, which Ubuntu installs beside WebKitGTK. On Windows it is Windows' own spell checker.
 
 Only prose is checked. Code blocks, \`inline code\`, URLs, HTML, the frontmatter block, \`[[wikilinks]]\` and \`#tags\` are never underlined. The built-in documentation is not checked, and neither is a note on your phone.
 
-Right-click a misspelled word to fix it. The dictionary's suggestions sit at the top of the menu: choose one to replace the word. "Learn Spelling" adds the word to your Mac's dictionary, which every app on the Mac shares, so it stops being underlined here and elsewhere.
+Right-click a misspelled word to fix it. The dictionary's suggestions sit at the top of the menu: choose one to replace the word. "Learn Spelling" adds the word to the system's dictionary, which every app on the machine shares, so it stops being underlined here and elsewhere.
 
-Words are judged in the language of the line they are on, so a German paragraph is checked as German.
+On a Mac, words are judged in the language of the line they are on, so a German paragraph is checked as German. On Linux and Windows they are judged in the desktop's language.
 
 Set \`editor.spellCheck\` to \`false\` under This app in Settings (\u2318,) and relaunch to turn spell checking off. The right-click menu then offers no suggestions either.
 
@@ -5900,10 +6040,7 @@ New Window in the File menu opens another one. A window is on one server at a ti
 
 The help button in the top right opens this manual in a window of its own, so reading it costs you nothing you had open. Pressing it again brings that window forward rather than opening a second one. It is the one window Ledge does not reopen at the next launch, since it is a button away.
 
-Two more keys for the window itself:
-
-- \u2325\u2318B hides the sidebar.
-- \u2303\u2318F enters full screen, also in the View menu.
+One more key for the window itself: \u2325\u2318B hides the sidebar. Full screen is Enter Full Screen in the View menu on a Mac, and the window manager's on Linux.
 `;
 
 // docs/user/05-finding-things.md
@@ -6052,7 +6189,7 @@ The button is about the four keys a shell is spawned with: \`cwd\`, \`profile\`,
 `;
 
 // docs/user/07-profiles-and-secrets.md
-var _07_profiles_and_secrets_default = "# Profiles and Secrets\n\nA profile is a named file of environment variables that lives outside your notes folder and is injected into the shells of any note that names it.\n\nUse one for secrets. Notes get synced, backed up, shared, and read by agents, so an API key written in an `env:` line travels everywhere the note does. With a profile, the note carries only a name.\n\n## Declare a profile\n\nAdd one line of frontmatter (see [[Frontmatter and Environments]] for the block itself):\n\n```\n---\nprofile: deploy\n---\n```\n\nProfile names may contain letters, digits, `-`, and `_`. The name resolves to a file under `~/.config/ledge/profiles/` on the machine holding the notes, here `deploy.env`, created for you the first time you open it for editing.\n\nA note names at most one profile, and any number of notes can share one. Every deploy-related note can say `profile: deploy` and pick up the same credentials.\n\nOne name is taken. `backup` is the profile `ledge backup setup` writes, holding the backup repository and its credentials ([[Keep Notes on a Remote Server]]). A note that says `profile: backup` runs with those variables, which is how a note runs restic by hand.\n\n## Edit a profile\n\nClick the profile name in the frontmatter block, or run \"Edit Note Profile\u2026\" from the command palette. The command appears whenever the current note names a profile.\n\nOn a touch device the palette command is the whole of it. The small key button beside the name is a pointer control and is not drawn there, and the command asks for nothing to be pointed at: it follows the note you are in.\n\nEither way you get Ledge's profile editor: KEY=value rows with the values masked.\n\nOn disk the profile is a plain dotenv file: `KEY=value` per line, `#` comments, and an optional `export ` prefix. Ledge creates it readable only by you. Hand edits and editor edits coexist, and saves from the editor preserve your comments.\n\n```\n# deploy.env\nAPI_TOKEN=abc123\nDEPLOY_REGION=eu-west-1\n```\n\n## How profiles layer\n\nProfile variables merge into the shell environment at spawn, above the note's `envFile` and below its inline `env:` lines. An `env:` line can therefore override a profile value for one note without editing the shared file.\n\nA `profile:` line naming a file that does not exist is skipped, and the shell spawns without it.\n\nA profile edit applies to newly spawned shells, like every frontmatter change. Changing which profile a note names raises the block's **Restart Note Shell** button; editing the values inside a profile file does not, so run the command yourself after that.\n\n## Profiles stay with the notes\n\nA profile lives on the machine that holds the notes and runs their blocks. With your notes on this Mac, that is this Mac. With your notes on a server, the file is on the server, \"Edit Note Profile\u2026\" edits it there, and the values never come to this app. [[Keep Notes on a Remote Server]] has the table of what lives where.\n\nWhen a note runs its blocks on a remote host over ssh, Ledge does not send the profile ([[Run Code on Remote Hosts]]). A secret passed on a remote command line would be visible in that machine's process table to anyone who can list processes. If a remote run needs credentials, put them on the remote machine.\n";
+var _07_profiles_and_secrets_default = "# Profiles and Secrets\n\nA profile is a named file of environment variables that lives outside your notes folder and is injected into the shells of any note that names it.\n\nUse one for secrets. Notes get synced, backed up, shared, and read by agents, so an API key written in an `env:` line travels everywhere the note does. With a profile, the note carries only a name.\n\n## Declare a profile\n\nAdd one line of frontmatter (see [[Frontmatter and Environments]] for the block itself):\n\n```\n---\nprofile: deploy\n---\n```\n\nProfile names may contain letters, digits, `-`, and `_`. The name resolves to a file under `~/.config/ledge/profiles/` on the machine holding the notes, here `deploy.env`, created for you the first time you open it for editing.\n\nA note names at most one profile, and any number of notes can share one. Every deploy-related note can say `profile: deploy` and pick up the same credentials.\n\nOne name is taken. `backup` is the profile `ledge backup setup` writes, holding the backup repository and its credentials ([[Keep Notes on a Remote Server]]). A note that says `profile: backup` runs with those variables, which is how a note runs restic by hand.\n\n## Edit a profile\n\nClick the profile name in the frontmatter block, or run \"Edit Note Profile\u2026\" from the command palette. The command appears whenever the current note names a profile.\n\nOn a touch device the palette command is the whole of it. The small key button beside the name is a pointer control and is not drawn there, and the command asks for nothing to be pointed at: it follows the note you are in.\n\nEither way you get Ledge's profile editor: KEY=value rows with the values masked.\n\nOn disk the profile is a plain dotenv file: `KEY=value` per line, `#` comments, and an optional `export ` prefix. Ledge creates it readable only by you. Hand edits and editor edits coexist, and saves from the editor preserve your comments.\n\n```\n# deploy.env\nAPI_TOKEN=abc123\nDEPLOY_REGION=eu-west-1\n```\n\n## How profiles layer\n\nProfile variables merge into the shell environment at spawn, above the note's `envFile` and below its inline `env:` lines. An `env:` line can therefore override a profile value for one note without editing the shared file.\n\nA `profile:` line naming a file that does not exist is skipped, and the shell spawns without it.\n\nA profile edit applies to newly spawned shells, like every frontmatter change. Changing which profile a note names raises the block's **Restart Note Shell** button; editing the values inside a profile file does not, so run the command yourself after that.\n\n## Profiles stay with the notes\n\nA profile lives on the machine that holds the notes and runs their blocks. With your notes on this computer, that is this computer. With your notes on a server, the file is on the server, \"Edit Note Profile\u2026\" edits it there, and the values never come to this app. [[Keep Notes on a Remote Server]] has the table of what lives where.\n\nWhen a note runs its blocks on a remote host over ssh, Ledge does not send the profile ([[Run Code on Remote Hosts]]). A secret passed on a remote command line would be visible in that machine's process table to anyone who can list processes. If a remote run needs credentials, put them on the remote machine.\n";
 
 // docs/user/08-run-code-on-remote-hosts.md
 var _08_run_code_on_remote_hosts_default = `# Run Code on Remote Hosts
@@ -6179,11 +6316,11 @@ Paste the link only if it came from your own server. A code holds no password or
 
 A server in your list can hand its code to your phone without a terminal. Open Notes On\u2026, and click the QR code icon on the server's row.
 
-Ledge shows the code, then the account, host, port and host key it names, then the same code as a link. Scan the QR code with Ledge on your phone ("Pair with a code" on [[Ledge on Your Phone]]), or use Copy Link and paste it into another Mac's Add Server form.
+Ledge shows the code, then the account, host, port and host key it names, then the same code as a link. Scan the QR code with Ledge on your phone ("Pair with a code" on [[Ledge on Your Phone]]), or use Copy Link and paste it into another computer's Add Server form.
 
-The code is made from what this Mac already has: the address it dials and the host key you pinned. Nothing is sent to the server to make it, and it holds no password or key. The phone still signs in with its own key, which has to be in the server's \`authorized_keys\`, or with a password.
+The code is made from what this computer already has: the address it dials and the host key you pinned. Nothing is sent to the server to make it, and it holds no password or key. The phone still signs in with its own key, which has to be in the server's \`authorized_keys\`, or with a password.
 
-The phone has to reach the host by the same address this Mac does. A server on your home network or tailnet works from a phone on that network or tailnet, and not from elsewhere. A destination that is an alias from your \`~/.ssh/config\` means nothing to a phone: give the server its real address here first.
+The phone has to reach the host by the same address this computer does. A server on your home network or tailnet works from a phone on that network or tailnet, and not from elsewhere. A destination that is an alias from your \`~/.ssh/config\` means nothing to a phone: give the server its real address here first.
 
 A server with no pinned key has no code, since the code names the key. Edit the server and use "Check Key Again" to pin one. A phone checks only Ed25519 and ECDSA host keys, so a server pinned to an RSA key has no code either.
 
@@ -6199,7 +6336,7 @@ Changing the address to a different machine does not. The button reads "Continue
 
 Use "Check Key Again" when a server you already have has legitimately rotated its host key. It is the same fingerprint step, on a connection you keep.
 
-This Mac cannot be removed or edited, and neither can the connection you are currently using: switch somewhere else first.
+The row for this computer cannot be removed or edited, and neither can the connection you are currently using: switch somewhere else first.
 
 ## Sign in with a password
 
@@ -6207,9 +6344,9 @@ Choose "A password" in the form and type the password for that account on that m
 
 Use it when the machine has no key on it yet. A fresh VPS with a password is a machine you can reach today, and setting up a key afterwards is a change you make once. Keys are the better long-term answer, and switching a connection over to one later is one edit.
 
-Ledge keeps the password in your Mac's keychain and never in \`~/.ledge\`. When ssh asks for it, ssh reads it from the keychain itself, so the password does not pass through Ledge on its way out.
+Ledge keeps the password in the system keychain and never in \`~/.ledge\`: the macOS keychain on a Mac, Credential Manager on Windows, and on Linux the desktop's keyring (GNOME Keyring or KWallet) through \`secret-tool\`, which the \`libsecret-tools\` package provides. When ssh asks for it, ssh reads it from the keychain itself, so the password does not pass through Ledge on its way out.
 
-Anything running as you on this Mac can read that keychain item. That is the same reach a private key file in \`~/.ssh\` gives, so a password here is neither safer nor less safe than the key it stands in for.
+Anything running as you on this computer can read that keychain item. That is the same reach a private key file in \`~/.ssh\` gives, so a password here is neither safer nor less safe than the key it stands in for.
 
 Removing the connection removes the password with it. So does switching that connection back to a key.
 
@@ -6225,17 +6362,17 @@ The picker opens on the connection in use, so Enter means stay and moving somewh
 
 Switching closes every tab and opens that machine's instead. Nothing is lost: the tabs are on the other machine and come back when you switch back.
 
-A connection that will not open costs you nothing. Ledge reaches the new machine before it lets go of the old one, so a typo or a sleeping laptop leaves you exactly where you were with the reason on screen. If the failure happens at launch, Ledge opens on this Mac and the bar reads "not reachable".
+A connection that will not open costs you nothing. Ledge reaches the new machine before it lets go of the old one, so a typo or a sleeping laptop leaves you exactly where you were with the reason on screen. If the failure happens at launch, Ledge opens on this computer and the bar reads "not reachable".
 
 ## Two machines at once
 
 New Window in the File menu opens a second window, and each window is on its own machine. Switching moves one window; a second window is how you have a build box and a VPS open side by side.
 
-A new window opens on this Mac. Switch it wherever you like from inside it.
+A new window opens on this computer. Switch it wherever you like from inside it.
 
-Each window is titled after the machine it is on, so the title bar reads "This Mac" or the name you gave the connection. That is the name in the Window menu too, and on a window's tab when macOS merges your windows into tabs.
+Each window is titled after the machine it is on, so the title bar reads "This Mac" ("This Computer", on Linux and Windows) or the name you gave the connection. On a Mac that is the name in the Window menu too, and on a window's tab when macOS merges your windows into tabs.
 
-The manual's window is the exception, titled "Documentation". It reads the copy of the manual that ships with this app, so it stays on this Mac whichever machine the window you opened it from is on.
+The manual's window is the exception, titled "Documentation". It reads the copy of the manual that ships with this app, so it stays on this computer whichever machine the window you opened it from is on.
 
 Each window keeps its own tabs and panes, and the server remembers them: switch a window back to a machine you used before and its arrangement comes back. Ledge reopens every window you left open at the next launch, each on the machine it was pointed at.
 
@@ -6261,9 +6398,9 @@ curl -fsSL https://ledge.sh/server.sh | sudo -iu ledge sh
 
 Running the same command again updates the server. A server that is already running goes on serving until it exits on its own, a minute or more after the last device disconnects, and the next connection starts the new version. [[Tutorial: Set Up a Ledge Server]] walks through the install on a fresh VPS, with an account for Ledge and the sshd hardening this page describes further down.
 
-A Mac that runs the Ledge app needs none of this. "Install Shell Command (ledge)" in the app's command palette puts \`ledge\` in \`~/.ledge/.server/bin\`, where an incoming ssh looks first, pointing at the app's own copy. Signing in as that account then reaches the notes the app shows, with the app's server answering both. On a Mac, the machine also needs Remote Login turned on ("Expose ssh carefully").
+A computer that runs the Ledge app needs none of this. "Install Shell Command (ledge)" in the app's command palette puts \`ledge\` in \`~/.ledge/.server/bin\`, where an incoming ssh looks first, pointing at the app's own copy. Signing in as that account then reaches the notes the app shows, with the app's server answering both. The machine also needs an ssh server: Remote Login on a Mac ("Expose ssh carefully"), or the \`openssh-server\` package on a Linux desktop.
 
-macOS and Linux are supported, on arm64 or x64. On Linux the floor is glibc 2.29, which means Debian 11, Ubuntu 20.04, RHEL 9, or anything newer. Alpine and other musl systems are not supported.
+macOS and Linux are supported, on arm64 or x64. On Linux the floor is glibc 2.29, which means Debian 11, Ubuntu 20.04, RHEL 9, or anything newer. Alpine and other musl systems are not supported. Windows itself is not either: the Windows app runs its server in WSL, which is Linux.
 
 Nothing else has to be installed and no port is opened. Ledge speaks its protocol over ssh's stdin and stdout.
 
@@ -6373,19 +6510,19 @@ On a Mac, the server needs Remote Login turned on in System Settings, under Gene
 | Notes, images, and the trash | Window size and position |
 | Workspaces, and where each attached folder is | The clipboard |
 | Shells, running blocks, and scrollback | Which servers you have added and their pinned host keys |
-| The vault and locked notes | Any stored passwords, in this Mac's keychain |
-| Profiles and their secrets | The \`ledge\` command, which reads this Mac's notes whichever server the window is on ([[The ledge CLI]]) |
+| The vault and locked notes | Any stored passwords, in this computer's keychain |
+| Profiles and their secrets | The \`ledge\` command, which reads this computer's notes whichever server the window is on ([[The ledge CLI]]) |
 | The settings for the shell, interpreters, the trash, and daily notes | The settings for the theme, font sizes, live preview, and update checks |
 
 Settings (\u2318,) has a tab for each column, Server and This app, and each tab is its own file. The This app half follows you between machines. The Server half describes the machine it is on, because a VPS's shell is not your laptop's.
 
-A Mac that runs the app is a server too. The app starts one of its own, so with no server added both columns are on this Mac, and the Server tab edits this Mac's file. Add a server and the left column moves there with your notes: the Server tab edits that machine's file, and so does "Edit Note Profile\u2026".
+A computer that runs the app is a server too. The app starts one of its own, so with no server added both columns are on this computer, and the Server tab edits this computer's file. Add a server and the left column moves there with your notes: the Server tab edits that machine's file, and so does "Edit Note Profile\u2026".
 
 Profile values never cross the connection. A note names a profile and the server reads the file at spawn, so the secrets exist only where the commands run ([[Profiles and Secrets]]).
 
 Unlocking a locked note sends the passphrase to the server, which is the only machine that can use it ([[Note Locking]]). The vault and its idle relock timer stay there.
 
-Each device unlocks for itself. Typing the passphrase on your Mac does not open the locked notes on your phone, and \u2318L on one leaves the other reading. Every window on the same Mac shares one unlock.
+Each device unlocks for itself. Typing the passphrase on your computer does not open the locked notes on your phone, and \u2318L on one leaves the other reading. Every window on the same computer shares one unlock.
 
 ## Back up the server
 
@@ -6405,7 +6542,7 @@ Run them as the account the server runs as, on the machine the server runs on.
 
 What a backup covers is decided at every run, because only the server knows it: the app home, every workspace folder you attached from elsewhere on the machine, and the profiles directory. Inside the app home it skips the daemon's socket and pidfile, the logs, the copy of this manual, and the installed server in \`.server\`. An attached folder that is not on disk at the time, on an unmounted volume say, is skipped, said on stderr, and shown by \`status\` until it is back.
 
-Backups run every hour while the server is up, and once more before it exits: after the app closes on a Mac, or after the last device disconnects from a VPS. The repository keeps 24 hourly, 30 daily, 12 weekly, and 24 monthly snapshots, and the rest are dropped.
+Backups run every hour while the server is up, and once more before it exits: after the app closes on a desktop, or after the last device disconnects from a VPS. The repository keeps 24 hourly, 30 daily, 12 weekly, and 24 monthly snapshots, and the rest are dropped.
 
 Three things to know before you rely on it:
 
@@ -6438,15 +6575,15 @@ A snapshot also lives in the account that pays for the server, so a lost login o
 
 ## Several devices on one server
 
-A server serves every device that connects to it. Your Mac and your phone can both be on the same server at once, reading the same notes and running commands ([[Ledge on Your Phone]]).
+A server serves every device that connects to it. Your computer and your phone can both be on the same server at once, reading the same notes and running commands ([[Ledge on Your Phone]]).
 
-Each device keeps its own tabs and panes. The server files them under the device that arranged them, so a phone does not open into a Mac's three-pane layout.
+Each device keeps its own tabs and panes. The server files them under the device that arranged them, so a phone does not open into a desktop's three-pane layout.
 
-A second Ledge window counts as another device here. Point two windows at one server and each is listed in the other's connection bar, and a note's terminal has one owner between them, exactly as a Mac and a phone would.
+A second Ledge window counts as another device here. Point two windows at one server and each is listed in the other's connection bar, and a note's terminal has one owner between them, exactly as a desktop and a phone would.
 
-The connection bar shows who else is connected: one other device by name, more than one as a count. Hover it for the full list. Names come from the devices themselves, so a Mac uses its computer name, and a device that gives no name reads as "another device".
+The connection bar shows who else is connected: one other device by name, more than one as a count. Hover it for the full list. Names come from the devices themselves, so a desktop uses its computer name, and a device that gives no name reads as "another device".
 
-Nothing appears there when you are the only one connected. A Mac that runs the app is a server of its own, so a phone signed in to it, or a second window on it, appears there the same way.
+Nothing appears there when you are the only one connected. A computer that runs the app is a server of its own, so a phone signed in to it, or a second window on it, appears there the same way.
 
 A note saved on one device appears on the other without a refresh. Everything else a server owns is shared the same way: the same workspaces, the same trash, the same tags and backlinks, the same vault.
 
@@ -6514,7 +6651,7 @@ You cannot start a run at all once the bar reads "disconnected". Every block's R
 
 A Ledge that has relaunched has no panel, and no way to show that run or stop it. So blocks left running on a server are stopped the next time Ledge connects to it, which includes switching to another connection and back. A terminal is not affected, because reattaching finds its shell where you left it.
 
-This reaches only the blocks that device started. A server can be carrying runs for more than one of your devices, and a phone connecting does not stop what your Mac left running.
+This reaches only the blocks that device started. A server can be carrying runs for more than one of your devices, and a phone connecting does not stop what your computer left running.
 
 A save that was in flight when the wire dropped is retried once the connection is back, and applied once, even if the first attempt had already landed.
 
@@ -6552,11 +6689,11 @@ Ledge also stops when the server hangs up on purpose rather than the wire failin
 // docs/user/10-ledge-on-your-phone.md
 var _10_ledge_on_your_phone_default = `# Ledge on Your Phone
 
-Ledge runs on an iPhone or iPad as a window onto a server. The phone holds no notes: it reaches a server over ssh, the way a Mac does in [[Keep Notes on a Remote Server]], and shows you what is there.
+Ledge runs on an iPhone or iPad as a window onto a server. The phone holds no notes: it reaches a server over ssh, the way the desktop app does in [[Keep Notes on a Remote Server]], and shows you what is there.
 
 Get Ledge for iPhone from the App Store. It runs on iOS and iPadOS 17 or newer, and it needs a server to connect to before it shows anything.
 
-A server that already serves your Mac needs nothing more. A machine without one needs the server installed first, as "Install the server" on that page describes, and the phone shows the same commands ("Set up a server" below).
+A server that already serves your desktop needs nothing more. A machine without one needs the server installed first, as "Install the server" on that page describes, and the phone shows the same commands ("Set up a server" below).
 
 ## The first screen
 
@@ -6564,7 +6701,7 @@ The first launch opens on "Connect to your Ledge server", which offers three way
 
 | Control | Use it when |
 | --- | --- |
-| Scan a pairing code | The server can show a code with \`ledge pair\`, or a Mac that already has the server can show one ("Pair with a code") |
+| Scan a pairing code | The server can show a code with \`ledge pair\`, or a desktop that already has the server can show one ("Pair with a code") |
 | I don't have a server yet | You have a Mac or Linux machine with ssh, and Ledge is not installed on it ("Set up a server") |
 | Add an existing server | Ledge is already installed on the server, and you would rather type its account and address ("Pair by address") |
 
@@ -6578,9 +6715,9 @@ ledge pair
 
 On a terminal, it first lists every address the machine has, with a note on which devices reach each one: its tailnet name and address, the address your ssh session reached, its public address when it runs in a cloud, its other network addresses, and its name. Type a number to pick one, or an address of your own as \`host\` or \`host:port\`, or press Return for the first. It then prints the code as a QR code, then the account, host, port, and host keys it holds, then the same code as a link. Without a terminal, it takes the first address and lists the rest under the code, and \`--host\` names one on the next run. \`ledge pair --help\` lists the other flags.
 
-A Mac that already has the server in its list can show the same code without a terminal: the QR code icon on the server's row in Notes On\u2026 ("Show a pairing code for a server" on [[Keep Notes on a Remote Server]]). The same link pastes into the Mac app's Add Server form ("Add a server from a pairing code" on that page).
+A desktop that already has the server in its list can show the same code without a terminal: the QR code icon on the server's row in Notes On\u2026 ("Show a pairing code for a server" on [[Keep Notes on a Remote Server]]). The same link pastes into the desktop app's Add Server form ("Add a server from a pairing code" on that page).
 
-The code names one address, and the reader connects to exactly that, so pick the one your other devices reach from where they will be. A tailnet name works from anywhere a device is on the tailnet. A home network address works from a device on that network. A cloud machine's public address works from anywhere, when its sshd is reachable from outside. A machine behind a router's port forward has an outside address no source knows: type it at the menu with its port, or give them with \`--host\` and \`--port\`. A Mac's code names the address the Mac dials, with the same reach.
+The code names one address, and the reader connects to exactly that, so pick the one your other devices reach from where they will be. A tailnet name works from anywhere a device is on the tailnet. A home network address works from a device on that network. A cloud machine's public address works from anywhere, when its sshd is reachable from outside. A machine behind a router's port forward has an outside address no source knows: type it at the menu with its port, or give them with \`--host\` and \`--port\`. A desktop's code names the address that desktop dials, with the same reach.
 
 On the phone, tap Scan a pairing code on the first screen, or in Add Server\u2026 inside the app ("More than one server" below), and point the camera at the QR code. Scan it from Ledge rather than the Camera app, which opens the code in Safari. Ledge shows what the code names and connects only when you tap Connect. Choose how to sign in first, the same way as in "Pair by address": with a key, whose line still has to be in the server's \`authorized_keys\`, or with a password. Ledge signs in only if the server offers one of the host keys in the code, so there is no fingerprint to check by eye.
 
@@ -6603,7 +6740,7 @@ Run them in a terminal on that machine, signed in as the account the phone shoul
 
 Copy commands puts them on the phone's pasteboard. Share commands hands them to AirDrop, Messages, or any app that can carry them to a computer with a terminal open on that machine.
 
-On a Mac, turn on Remote Login first, in System Settings under General, then Sharing. A Mac that runs the Ledge app needs only "Install Shell Command (ledge)" from the app's command palette in place of the first command: it puts \`ledge\` where the phone's ssh looks, pointing at the app's own copy, so the phone sees the same notes the app shows. The second command then prints the code.
+On a Mac, turn on Remote Login first, in System Settings under General, then Sharing; on a Linux desktop, install the \`openssh-server\` package. A computer that runs the Ledge app needs only "Install Shell Command (ledge)" from the app's command palette in place of the first command: it puts \`ledge\` where the phone's ssh looks, pointing at the app's own copy, so the phone sees the same notes the app shows. The second command then prints the code.
 
 The machine needs sshd running and an address the phone can reach. [[Keep Notes on a Remote Server]] has the details of the install, including installing with Bun instead, and [[Tutorial: Set Up a Ledge Server]] walks through a fresh VPS.
 
@@ -6627,11 +6764,11 @@ The command adds that line to the file, creating \`~/.ssh\` first if the account
 mkdir -p ~/.ssh && chmod 700 ~/.ssh && printf '\\n%s\\n' 'restrict,command="PATH=$HOME/.ledge/.server/bin:$PATH ledge serve" ecdsa-sha2-nistp256 AAAA... ledge-iphone-3f2a91c0' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys
 \`\`\`
 
-Run it on the server, signed in as the account Ledge uses: over ssh from a Mac, or in the provider's web console for a new VPS. Copy command puts it on the phone's pasteboard. Share command hands it to AirDrop, Messages, or any app that can carry it to that terminal, which is where the pasteboard on a phone falls short. The comment at the end of the line names the phone, so the line is easy to find again when you want to revoke it.
+Run it on the server, signed in as the account Ledge uses: over ssh from your computer, or in the provider's web console for a new VPS. Copy command puts it on the phone's pasteboard. Share command hands it to AirDrop, Messages, or any app that can carry it to that terminal, which is where the pasteboard on a phone falls short. The comment at the end of the line names the phone, so the line is easy to find again when you want to revoke it.
 
 The line arrives already restricted, in the way "Restrict the key to Ledge" on [[Keep Notes on a Remote Server]] describes: the phone's key can speak Ledge's protocol and nothing else. It looks for \`ledge\` in \`~/.ledge/.server/bin\` first and then on the PATH an incoming ssh gets, so a server installed in either place starts ("Check that ssh can find the server" on the same page).
 
-The third is Connect. The phone dials the server, shows its host key fingerprint, and asks "Is this the server?" alongside the command that prints the same fingerprint on the server. Trust pins the key, and a server that later presents a different one is refused, the same as on a Mac.
+The third is Connect. The phone dials the server, shows its host key fingerprint, and asks "Is this the server?" alongside the command that prints the same fingerprint on the server. Trust pins the key, and a server that later presents a different one is refused, the same as on the desktop.
 
 Ledge adds the server only once \`ledge serve\` answers there. On a machine where ssh cannot find it, Connect says "Ledge's server is not installed" and adds nothing. Install it, then tap Connect again.
 
@@ -6653,11 +6790,11 @@ Removing the last server returns the phone to the first screen. Deleting the app
 
 ## More than one server
 
-Inside the app the connection bar works as on a Mac: tap it to add, edit, remove, or switch servers, with the same fingerprint step ([[Keep Notes on a Remote Server]]). The form shows the command that installs the phone's key where a Mac's shows a key path, with Share Command beside Copy Command.
+Inside the app the connection bar works as on the desktop: tap it to add, edit, remove, or switch servers, with the same fingerprint step ([[Keep Notes on a Remote Server]]). The form shows the command that installs the phone's key where the desktop's shows a key path, with Share Command beside Copy Command.
 
-Add Server\u2026 starts with Scan a pairing code, where a Mac's form has a field for the pasted link. It opens the camera, then the same "Pair with a server" screen as the first launch, and the app reopens on the new server once you tap Connect there. Cancel returns you to the form, where you can type the address instead. Editing a server has no scan: a code never replaces a host key the phone already has.
+Add Server\u2026 starts with Scan a pairing code, where the desktop's form has a field for the pasted link. It opens the camera, then the same "Pair with a server" screen as the first launch, and the app reopens on the new server once you tap Connect there. Cancel returns you to the form, where you can type the address instead. Editing a server has no scan: a code never replaces a host key the phone already has.
 
-A phone and a Mac can be on one server at once. Each keeps its own tabs, and a note's terminal has one owner between them.
+A phone and a desktop can be on one server at once. Each keeps its own tabs, and a note's terminal has one owner between them.
 
 ## What a phone does
 
@@ -6676,9 +6813,9 @@ A phone and a Mac can be on one server at once. Each keeps its own tabs, and a n
 
 The pages for those features say how each works on a touch screen: Run on every block, the Code Block button, and the control keys above the keyboard in [[Running Code]], adding a picture in [[Images]], the mode chips under the search field in [[Finding Things]], and splits in [[Panes and Tabs]].
 
-Tapping through the tree reuses one tab rather than filling the strip, since a note you tap opens as an italic preview ([[Panes and Tabs]]). A long press on the tab holds Keep Tab Open, which is what makes it stay, and so does typing in the note. It matters more here than on a Mac: there is no \u2318W, so a strip that filled up would take a long press and a menu item per tab to empty.
+Tapping through the tree reuses one tab rather than filling the strip, since a note you tap opens as an italic preview ([[Panes and Tabs]]). A long press on the tab holds Keep Tab Open, which is what makes it stay, and so does typing in the note. It matters more here than on a desktop: there is no \u2318W, so a strip that filled up would take a long press and a menu item per tab to empty.
 
-A block keeps running on the server while the app is in the background, and what it printed is waiting when you come back. A program that needs a whole terminal belongs in a Mac's drawer on the same server.
+A block keeps running on the server while the app is in the background, and what it printed is waiting when you come back. A program that needs a whole terminal belongs in a desktop's drawer on the same server.
 
 Unlocking a locked note asks for the passphrase every time. The phone stores none of it, and Face ID does not stand in for it. The relock timer is the server's, so a phone put away for an hour finds its locked notes closed again ([[Note Locking]]).
 
@@ -6778,9 +6915,9 @@ A reference points at the file from the note that holds it, the way Markdown ref
 
 Run **Insert Image\u2026** from the palette to pick a picture instead of pasting one. Ledge saves it and inserts the reference exactly as a paste does.
 
-On a Mac this opens a file dialog. On a phone it asks where the picture is: **Photo Library**, **Take Photo**, or **Choose File** for one in the Files app. The button for it sits on the bar above the keyboard. Take Photo appears only on a device with a camera, and the first time it asks permission to use it.
+On a desktop this opens a file dialog. On a phone it asks where the picture is: **Photo Library**, **Take Photo**, or **Choose File** for one in the Files app. The button for it sits on the bar above the keyboard. Take Photo appears only on a device with a camera, and the first time it asks permission to use it.
 
-On a Mac, a picture chosen this way is saved as a JPEG when it already is one (a photograph stays a tenth of the size it would be as a PNG), and as a PNG otherwise. On a phone it is saved as a JPEG, except a PNG chosen from Files, which stays a PNG so a transparent background survives. A picture pasted on a phone is saved as a JPEG too. A phone does not carry location data over.
+On a desktop, a picture chosen this way is saved as a JPEG when it already is one (a photograph stays a tenth of the size it would be as a PNG), and as a PNG otherwise. On a phone it is saved as a JPEG, except a PNG chosen from Files, which stays a PNG so a transparent background survives. A picture pasted on a phone is saved as a JPEG too. A phone does not carry location data over.
 
 ## What renders
 
@@ -6841,7 +6978,7 @@ One passphrase covers every locked note, on the device you type it on.
 - The vault also relocks itself after 15 minutes in which no note changed. Reading a note does not hold it open, and neither does an agent working in your notes while you are away.
 - Quitting Ledge locks its notes, and so does a crash. The next launch asks for the passphrase again.
 
-Unlocking covers every window on that Mac, so opening a second window does not ask again.
+Unlocking covers every window on that computer, so opening a second window does not ask again.
 
 Once unlocked, every locked note reads and edits like a normal note, and saves go back to disk encrypted. Locked notes show a lock glyph in the sidebar and in \u2318P, drawn open while the vault is unlocked, so you can see what is readable without opening anything.
 
@@ -6853,7 +6990,7 @@ A locked note is self-contained. Carried to another of your machines, it unlocks
 
 If you keep notes on a server and reach them from more than one device ([[Keep Notes on a Remote Server]]), each device unlocks for itself.
 
-Unlocking on your Mac does not unlock your phone. Both use the same passphrase, and neither can see the other's locked notes until it is typed there. \u2318L works the same way: it locks the device you run it on and leaves the others reading.
+Unlocking on your computer does not unlock your phone. Both use the same passphrase, and neither can see the other's locked notes until it is typed there. \u2318L works the same way: it locks the device you run it on and leaves the others reading.
 
 This is the behavior a stolen phone needs. Somebody holding an unlocked, paired device still has to know the passphrase to open a locked note on it.
 
@@ -6907,86 +7044,10 @@ Locking protects notes at rest and from the software Ledge invites in. It does n
 `;
 
 // docs/user/14-agents-and-ledge.md
-var _14_agents_and_ledge_default = "# Agents and Ledge\n\nLedge is built to be worked by AI agents as well as by you. An agent CLI such as Claude Code can read, search, create, and edit your notes through Ledge's MCP server. A terminal launched inside a note already knows which note it is in, and a `prompt` code fence turns a paragraph of instructions into a runnable block.\n\n## Connect an agent\n\nLedge ships an MCP server. `ledge mcp` serves it on stdio, so install the `ledge` command first (see [[The ledge CLI]]). Any MCP-speaking agent can use it. For Claude Code it is one line, in your own terminal:\n\n```sh norun\nclaude mcp add ledge -- ledge mcp\n```\n\nThe MCP server reads the notes on the machine it runs on. For an agent running on a server, the same line works there, since the server install puts `ledge` on that machine's PATH too.\n\nThe server exposes eleven tools:\n\n| Read | Write |\n| --- | --- |\n| `list_workspaces`, `list_notes`, `read_note`, `search_notes`, `backlinks`, `tags`, `settings` | `create_note`, `daily_note`, `append_note`, `edit_note` |\n\nNotes are addressed by title, which survives renames, so an agent's references do not go stale. Every tool goes through the same store and the same path guards as the app.\n\nTwo boundaries hold in every case: there is no delete tool, and locked notes refuse their bodies to every agent surface (see [[Note Locking]]).\n\n## Agents and folders\n\nTwo notes in different folders may share a title, so `list_notes` tells them apart: every row says which folder its note is in, and a note at the top level says nothing. Read a note by that title and the answer names its folder too.\n\nListing, searching, and the tag tools take a `folder` to narrow to one, and it covers the folders inside it as well. The tools that address a note by title take one too, which is how an agent says which of two notes sharing a title it means. `create_note` takes one to place a new note, creating the folder if it is new, and `daily_note` takes one for the day it creates today's note.\n\nWithout a folder a new note lands at the top level of the workspace, which is where your own New Note puts one. There is no tool for moving a note afterwards, and none for renaming or deleting a folder: filing is yours, in the sidebar ([[Notes and Workspaces]]).\n\n## Agents know which note they are in\n\nEvery shell a note spawns carries two environment variables: `LEDGE_NOTE`, the note's file, and `LEDGE_WORKSPACE`, its workspace folder. An agent launched in a note's terminal drawer picks these up through the MCP server:\n\n- `read_note` with no arguments reads the note the terminal belongs to.\n- `append_note` and `edit_note` default to that note.\n- `create_note` lands in its workspace, at the top level unless it names a folder.\n\nSo \"summarize this note\" or \"add a TODO section here\" needs no explanation of what \"this\" means. Open the note you are working in, press \u2303` for its terminal, start your agent, and talk about \"this note\" and \"this workspace\" in plain words.\n\n## Prompt fences\n\nA fenced block whose language is `prompt` is an agent run. Write instructions in it and press \u2318\u21A9. The block's text is piped to the agent CLI in one-shot mode, and the output streams into the panel below like any other run ([[Running Code]]).\n\nA prompt fence in a note might read:\n\n```prompt norun\nSummarize this note in one sentence.\n```\n\nThe answer streams into the panel beneath it. Instructions can also change things: \"append a Next steps section to this note\", or \"create a note titled Retro from what we discussed above\".\n\nThe block runs from the note's own shell, so the agent inherits the note's `cwd`, `env`, and the environment variables above.\n\nTwo things to expect. There is a pause before the answer appears, because one-shot mode thinks first and prints once. And since nobody is present to answer follow-up questions, the agent is instructed to act and report rather than ask.\n\nBy default the fence runs Claude Code (`claude -p`) with Ledge's own tools pre-authorized, because a non-interactive run has no one to click \"allow\". The command is an interpreter entry in Settings (\u2318,) under `blocks.interpreters`, key `prompt`. Point it at any CLI that reads its prompt on stdin to switch agents.\n\nA daily template carrying a prompt fence such as `Summarize [[{{yesterday}}]]` gives every day's note a one-keystroke briefing (see [[Daily Notes and Templates]]).\n\n## What agents cannot see\n\nAgents see the titles, bodies, tags, and links of ordinary notes. They can read this manual too, so \"check the Ledge docs\" is a fair instruction.\n\nThey never see the body of a locked note. Reads refuse with an explanation, searches skip locked notes and report how many they skipped, and listings flag them so an agent can plan around it.\n\nSettings are readable but not writable. The `settings` tool shows an agent your `settings.jsonc` with its comments, so it can answer \"which python is that block using\" from your actual configuration and name the line to change. Making the change is yours, in the app (\u2318,), and it applies at the next launch.\n\nDeletion is yours alone, in the app, where the trash and Undo live.\n";
+var _14_agents_and_ledge_default = "# Agents and Ledge\n\nLedge is built to be worked by AI agents as well as by you. An agent CLI such as Claude Code can read, search, create, and edit your notes through Ledge's MCP server. A terminal launched inside a note already knows which note it is in, and a `prompt` code fence turns a paragraph of instructions into a runnable block.\n\n## Connect an agent\n\nLedge ships an MCP server. `ledge mcp` serves it on stdio, so install the `ledge` command first (see [[The ledge CLI]]). Any MCP-speaking agent can use it. For Claude Code it is one line, in your own terminal:\n\n```sh norun\nclaude mcp add ledge -- ledge mcp\n```\n\nThe MCP server reads the notes on the machine it runs on. For an agent running on a server, the same line works there, since the server install puts `ledge` on that machine's PATH too. On Windows the notes are in WSL, so run the agent there, where `ledge` already is.\n\nThe server exposes eleven tools:\n\n| Read | Write |\n| --- | --- |\n| `list_workspaces`, `list_notes`, `read_note`, `search_notes`, `backlinks`, `tags`, `settings` | `create_note`, `daily_note`, `append_note`, `edit_note` |\n\nNotes are addressed by title, which survives renames, so an agent's references do not go stale. Every tool goes through the same store and the same path guards as the app.\n\nTwo boundaries hold in every case: there is no delete tool, and locked notes refuse their bodies to every agent surface (see [[Note Locking]]).\n\n## Agents and folders\n\nTwo notes in different folders may share a title, so `list_notes` tells them apart: every row says which folder its note is in, and a note at the top level says nothing. Read a note by that title and the answer names its folder too.\n\nListing, searching, and the tag tools take a `folder` to narrow to one, and it covers the folders inside it as well. The tools that address a note by title take one too, which is how an agent says which of two notes sharing a title it means. `create_note` takes one to place a new note, creating the folder if it is new, and `daily_note` takes one for the day it creates today's note.\n\nWithout a folder a new note lands at the top level of the workspace, which is where your own New Note puts one. There is no tool for moving a note afterwards, and none for renaming or deleting a folder: filing is yours, in the sidebar ([[Notes and Workspaces]]).\n\n## Agents know which note they are in\n\nEvery shell a note spawns carries two environment variables: `LEDGE_NOTE`, the note's file, and `LEDGE_WORKSPACE`, its workspace folder. An agent launched in a note's terminal drawer picks these up through the MCP server:\n\n- `read_note` with no arguments reads the note the terminal belongs to.\n- `append_note` and `edit_note` default to that note.\n- `create_note` lands in its workspace, at the top level unless it names a folder.\n\nSo \"summarize this note\" or \"add a TODO section here\" needs no explanation of what \"this\" means. Open the note you are working in, press \u2303` for its terminal, start your agent, and talk about \"this note\" and \"this workspace\" in plain words.\n\n## Prompt fences\n\nA fenced block whose language is `prompt` is an agent run. Write instructions in it and press \u2318\u21A9. The block's text is piped to the agent CLI in one-shot mode, and the output streams into the panel below like any other run ([[Running Code]]).\n\nA prompt fence in a note might read:\n\n```prompt norun\nSummarize this note in one sentence.\n```\n\nThe answer streams into the panel beneath it. Instructions can also change things: \"append a Next steps section to this note\", or \"create a note titled Retro from what we discussed above\".\n\nThe block runs from the note's own shell, so the agent inherits the note's `cwd`, `env`, and the environment variables above.\n\nTwo things to expect. There is a pause before the answer appears, because one-shot mode thinks first and prints once. And since nobody is present to answer follow-up questions, the agent is instructed to act and report rather than ask.\n\nBy default the fence runs Claude Code (`claude -p`) with Ledge's own tools pre-authorized, because a non-interactive run has no one to click \"allow\". The command is an interpreter entry in Settings (\u2318,) under `blocks.interpreters`, key `prompt`. Point it at any CLI that reads its prompt on stdin to switch agents.\n\nA daily template carrying a prompt fence such as `Summarize [[{{yesterday}}]]` gives every day's note a one-keystroke briefing (see [[Daily Notes and Templates]]).\n\n## What agents cannot see\n\nAgents see the titles, bodies, tags, and links of ordinary notes. They can read this manual too, so \"check the Ledge docs\" is a fair instruction.\n\nThey never see the body of a locked note. Reads refuse with an explanation, searches skip locked notes and report how many they skipped, and listings flag them so an agent can plan around it.\n\nSettings are readable but not writable. The `settings` tool shows an agent your `settings.jsonc` with its comments, so it can answer \"which python is that block using\" from your actual configuration and name the line to change. Making the change is yours, in the app (\u2318,), and it applies at the next launch.\n\nDeletion is yours alone, in the app, where the trash and Undo live.\n";
 
 // docs/user/15-the-ledge-cli.md
-var _15_the_ledge_cli_default = `# The ledge CLI
-
-The \`ledge\` command lists, reads, searches, creates, and appends to notes from any terminal. The running app follows along live, because a CLI write is an ordinary file change.
-
-## Install
-
-Run "Install Shell Command (ledge)" from the command palette.
-
-It writes one small launcher, \`ledge\`, into \`~/.ledge/.server/bin\`, pointing at this copy of Ledge, and adds that folder to your PATH in your shell's startup file if it is not there yet. Open a new terminal afterwards. If you move the app, run it again.
-
-The same launcher is what lets your phone reach this Mac's notes ([[Ledge on Your Phone]]): \`ledge serve\` over ssh is how a Ledge app reaches any machine, and \`ledge\` reads the notes on the machine it runs on. That is this Mac's from a terminal here, and a server's from a terminal there, where the server install already put \`ledge\` on the PATH ([[Keep Notes on a Remote Server]]). \`ledge help\` lists the server verbs beside the notes verbs.
-
-## The verbs
-
-\`ledge help\` prints the full usage.
-
-| Verb | What it does |
-| --- | --- |
-| \`ledge ls\` | Lists notes. |
-| \`ledge search <query>\` | Prints \`path:line: match\` rows like grep, and exits nonzero on no hits. |
-| \`ledge cat <title>\` | Prints a note's Markdown. |
-| \`ledge tags\` | Lists the workspace's tags with counts. \`ledge tags <name>\` lists the notes bearing one. |
-| \`ledge workspaces\` | Lists the workspace roots. |
-| \`ledge new <title>\` | Creates a note, with the body piped on stdin or stamped from \`--template\`, in the folder you are standing in or the one \`-f\` names. |
-| \`ledge append <title>\` | Appends to a note, or to one heading's section with \`--heading\`. |
-| \`ledge today\` | Opens today's daily note in the app. |
-| \`ledge <title>\` | Opens the app at that note. \`ledge\` alone just opens the app. |
-| \`ledge backup\` | Backs this machine up to a bucket: \`setup\`, \`now\`, \`status\`, \`snapshots\`, \`restore\`, \`paths\`, \`restic\` ([[Keep Notes on a Remote Server]]). |
-
-In a terminal, once the shim is on your PATH:
-
-\`\`\`sh norun
-ledge ls
-ledge search "spawn params"
-ledge cat "Shipping Notes"
-\`\`\`
-
-Notes are addressed by title. An argument ending in \`.md\` is treated as a path instead.
-
-\`\`\`
-ledge new "Standup" --template "Meeting"
-git log --oneline -5 | ledge append "Release Notes" --heading "Shipped"
-\`\`\`
-
-\`--template\` stamps the usual \`{{tokens}}\` (see [[Daily Notes and Templates]]). Titles never clobber: a duplicate gets a numbered file, the same as in the app.
-
-## Scope: workspace, folder, and note
-
-Run \`ledge\` from inside a workspace folder and it scopes itself there. \`ls\` and \`search\` cover that workspace, and \`new\` creates in it.
-
-Stand in a folder inside the workspace and it narrows one more step, the way any other shell command works on the directory you are in:
-
-\`\`\`sh norun
-cd ~/Notes/projects
-ledge ls                     # only the notes in projects, and below it
-ledge search "rate limit"    # only that folder
-ledge new "API Rollout"      # creates ~/Notes/projects/api-rollout.md
-\`\`\`
-
-\`-f <folder>\` says it outright, from anywhere. \`ledge ls -f admin\` lists that folder, and \`ledge new "Expenses" -f admin/2026\` creates the folder if it is new. See [[Notes and Workspaces]] for folders in the app.
-
-\`-f\` is also how you say which of two notes sharing a title you mean: \`ledge cat "Plan" -f projects\`. The folder you are standing in never does that, only \`-f\`, so a title always reaches the whole workspace no matter where you run it from.
-
-\`ledge today\` is the one exception. It takes \`-f\`, which overrides the \`daily.folder\` setting for that call, but it ignores the folder you are standing in: today's note is found by its date, and where it lives should not depend on where you happened to be when you first ran it ([[Daily Notes and Templates]]).
-
-Inside a note's terminal drawer it also knows the note, so a bare \`ledge append -m "TODO: check the logs"\` appends to the note the terminal belongs to.
-
-Three flags override the scope: \`-w <workspace>\` targets a specific workspace, \`-f <folder>\` targets a folder, and \`--all\` widens \`ls\` and \`search\` to every workspace.
-
-## Piping and JSON output
-
-Results go to stdout and everything conversational to stderr, so pipes stay clean. \`--json\` switches any verb to machine-readable output.
-
-The CLI dispatches through the same handlers as the MCP tools ([[Agents and Ledge]]), so it follows the same rules: titles resolve the same way, locked notes refuse their bodies, and there is no delete verb.
-
-That makes it an agent surface in its own right. An agent that can run shell commands can work your notes with \`ledge\` alone, with no MCP setup.
-`;
+var _15_the_ledge_cli_default = "# The ledge CLI\n\nThe `ledge` command lists, reads, searches, creates, and appends to notes from any terminal. The running app follows along live, because a CLI write is an ordinary file change.\n\n## Install\n\nRun \"Install Shell Command (ledge)\" from the command palette.\n\nIt writes one small launcher, `ledge`, into `~/.ledge/.server/bin`, pointing at this copy of Ledge, and adds that folder to your PATH in your shell's startup file if it is not there yet. Open a new terminal afterwards. If you move the app, run it again.\n\nOn Windows there is nothing to install. The CLI runs in WSL, where the app installs its server, and a new WSL terminal already finds `ledge`. `ledge <title>` there opens the Windows app, once it has started at least once ([[Getting Started#Ledge on Windows]]).\n\nThe same launcher is what lets your phone reach this computer's notes ([[Ledge on Your Phone]]): `ledge serve` over ssh is how a Ledge app reaches any machine, and `ledge` reads the notes on the machine it runs on. That is this computer's from a terminal here, and a server's from a terminal there, where the server install already put `ledge` on the PATH ([[Keep Notes on a Remote Server]]). `ledge help` lists the server verbs beside the notes verbs.\n\n## The verbs\n\n`ledge help` prints the full usage.\n\n| Verb | What it does |\n| --- | --- |\n| `ledge ls` | Lists notes. |\n| `ledge search <query>` | Prints `path:line: match` rows like grep, and exits nonzero on no hits. |\n| `ledge cat <title>` | Prints a note's Markdown. |\n| `ledge tags` | Lists the workspace's tags with counts. `ledge tags <name>` lists the notes bearing one. |\n| `ledge workspaces` | Lists the workspace roots. |\n| `ledge new <title>` | Creates a note, with the body piped on stdin or stamped from `--template`, in the folder you are standing in or the one `-f` names. |\n| `ledge append <title>` | Appends to a note, or to one heading's section with `--heading`. |\n| `ledge today` | Opens today's daily note in the app. |\n| `ledge <title>` | Opens the app at that note. `ledge` alone just opens the app. |\n| `ledge backup` | Backs this machine up to a bucket: `setup`, `now`, `status`, `snapshots`, `restore`, `paths`, `restic` ([[Keep Notes on a Remote Server]]). |\n\nIn a terminal, once the shim is on your PATH:\n\n```sh norun\nledge ls\nledge search \"spawn params\"\nledge cat \"Shipping Notes\"\n```\n\nNotes are addressed by title. An argument ending in `.md` is treated as a path instead.\n\n```\nledge new \"Standup\" --template \"Meeting\"\ngit log --oneline -5 | ledge append \"Release Notes\" --heading \"Shipped\"\n```\n\n`--template` stamps the usual `{{tokens}}` (see [[Daily Notes and Templates]]). Titles never clobber: a duplicate gets a numbered file, the same as in the app.\n\n## Scope: workspace, folder, and note\n\nRun `ledge` from inside a workspace folder and it scopes itself there. `ls` and `search` cover that workspace, and `new` creates in it.\n\nStand in a folder inside the workspace and it narrows one more step, the way any other shell command works on the directory you are in:\n\n```sh norun\ncd ~/Notes/projects\nledge ls                     # only the notes in projects, and below it\nledge search \"rate limit\"    # only that folder\nledge new \"API Rollout\"      # creates ~/Notes/projects/api-rollout.md\n```\n\n`-f <folder>` says it outright, from anywhere. `ledge ls -f admin` lists that folder, and `ledge new \"Expenses\" -f admin/2026` creates the folder if it is new. See [[Notes and Workspaces]] for folders in the app.\n\n`-f` is also how you say which of two notes sharing a title you mean: `ledge cat \"Plan\" -f projects`. The folder you are standing in never does that, only `-f`, so a title always reaches the whole workspace no matter where you run it from.\n\n`ledge today` is the one exception. It takes `-f`, which overrides the `daily.folder` setting for that call, but it ignores the folder you are standing in: today's note is found by its date, and where it lives should not depend on where you happened to be when you first ran it ([[Daily Notes and Templates]]).\n\nInside a note's terminal drawer it also knows the note, so a bare `ledge append -m \"TODO: check the logs\"` appends to the note the terminal belongs to.\n\nThree flags override the scope: `-w <workspace>` targets a specific workspace, `-f <folder>` targets a folder, and `--all` widens `ls` and `search` to every workspace.\n\n## Piping and JSON output\n\nResults go to stdout and everything conversational to stderr, so pipes stay clean. `--json` switches any verb to machine-readable output.\n\nThe CLI dispatches through the same handlers as the MCP tools ([[Agents and Ledge]]), so it follows the same rules: titles resolve the same way, locked notes refuse their bodies, and there is no delete verb.\n\nThat makes it an agent surface in its own right. An agent that can run shell commands can work your notes with `ledge` alone, with no MCP setup.\n";
 
 // docs/user/16-tutorial-run-a-project.md
 var _16_tutorial_run_a_project_default = `# Tutorial: Run a Project from a Note
@@ -7196,7 +7257,7 @@ Sync workspace folders, not \`~/.ledge\` itself. The app home holds machine-loca
 
 1. Create a folder inside iCloud Drive, Dropbox, or any synced location.
 2. Run "Attach Folder as Workspace\u2026" and give its path, or press Choose Folder\u2026 to pick it.
-3. On a second Mac, attach the same folder there.
+3. On a second computer, attach the same folder there.
 
 Notes you write are files in the synced folder, and the service carries them.
 
@@ -7251,17 +7312,17 @@ A repository is also how a workspace reaches other people, with a clone each ([[
 Both setups start with a folder in the right place. Notes in a managed workspace live inside \`~/.ledge\`, which a sync service will not carry, so the workspace has to move out first.
 
 1. Close the workspace (\u232B on its row). Closing only detaches the folder; no note is touched.
-2. In Finder, move the folder out of \`~/.ledge\` (it is hidden: press \u21E7\u2318. in Finder to show it, or use \u21E7\u2318G and type \`~/.ledge\`) into the synced location.
+2. Move the folder out of \`~/.ledge\` into the synced location. The folder is hidden: Finder's Go to Folder\u2026 takes the path, and so does Ctrl+L in GNOME Files. On Windows it is in WSL, under Linux in File Explorer.
 3. Run "Attach Folder as Workspace\u2026" and give its new path.
-4. Attach the same folder on your other Mac.
+4. Attach the same folder on your other computer.
 
 The whole folder travels: notes, images, and trash together, with references intact. The workspace continues at its new home as an ordinary attached folder.
 
 ## What syncing does not carry
 
-Syncing workspace folders syncs all of your notes. It does not touch Ledge's own state in \`~/.ledge\`: your settings, the list of which folders are workspaces, and your window layout. Those are machine-local, since a list of folder paths means little on another Mac.
+Syncing workspace folders syncs all of your notes. It does not touch Ledge's own state in \`~/.ledge\`: your settings, the list of which folders are workspaces, and your window layout. Those are machine-local, since a list of folder paths means little on another computer.
 
-So setting up a new Mac is a short manual step: install Ledge, attach your synced folders, and redo any settings you care about. If your \`settings.jsonc\` is heavily customized, keep a copy alongside your notes.
+So setting up a new computer is a short manual step: install Ledge, attach your synced folders, and redo any settings you care about. If your \`settings.jsonc\` is heavily customized, keep a copy alongside your notes.
 
 There is nothing else to migrate. Notes are files, so there is no export and no import. Locked notes carry what they need to be decrypted, so on the new machine the passphrase alone opens them, with no vault file to move ([[Note Locking]]).
 
@@ -7273,14 +7334,14 @@ They combine: a synced drive for the always-on workspaces, a git repo for the on
 `;
 
 // docs/user/20-tutorial-set-up-a-ledge-server.md
-var _20_tutorial_set_up_a_ledge_server_default = '# Tutorial: Set Up a Ledge Server\n\nTurn a fresh Linux VPS into a Ledge server: an account for Ledge, the server package, a key that can do nothing but Ledge, and an sshd that ignores everyone else.\n\nThis builds on [[Keep Notes on a Remote Server]], which is the reference for every step here. The commands assume Debian or Ubuntu. Any Linux with glibc 2.29 or newer works, so substitute your package manager on anything else.\n\nTwo accounts appear throughout. `you@vps` is the account your provider gave you, which can `sudo`. `ledge@vps` is the account you create in step 1, which cannot.\n\n## 1. Create an account for Ledge\n\nOn the VPS, as your own account:\n\n```sh norun\nsudo adduser --disabled-password --gecos "" ledge\n```\n\nThe account has no password and no `sudo`. Everything Ledge does on this machine runs as this account: the server, the shells, and every block in every note. A key for it that is ever stolen cannot become root.\n\nIf your notes need `sudo`, that is a decision for later, made with `visudo` and as narrow as you can make it.\n\n`adduser` gives the account bash as its login shell, which is one of the two shells Ledge runs blocks in.\n\n## 2. Make a key on your Mac\n\nIn a terminal on your Mac:\n\n```sh norun\nssh-keygen -t ed25519 -f ~/.ssh/ledge -C ledge@laptop\ncat ~/.ssh/ledge.pub\n```\n\nLeave the key\'s passphrase empty, or use one your ssh agent already holds. Ledge\'s ssh runs with no terminal attached, so a passphrase it would have to type at a prompt never gets typed. This is about the key file only: signing in with the account\'s password is a choice on the form, and [[Keep Notes on a Remote Server]] covers it. This tutorial uses a key so that step 8 can turn passwords off.\n\nCopy the printed line, then put it on the VPS as the new account\'s only key. As your own account there, with the line pasted in place of the placeholder:\n\n```sh norun\nsudo install -d -m 700 -o ledge -g ledge /home/ledge/.ssh\necho \'ssh-ed25519 AAAA... ledge@laptop\' | sudo tee /home/ledge/.ssh/authorized_keys\nsudo chown ledge:ledge /home/ledge/.ssh/authorized_keys\nsudo chmod 600 /home/ledge/.ssh/authorized_keys\n```\n\nThe line goes in unrestricted for now. Step 7 restricts it, once you know the server works.\n\n## 3. Install the server\n\nStill on the VPS, as your own account, install the server into the new account\'s home:\n\n```sh norun\ncurl -fsSL https://ledge.sh/server.sh | sudo -iu ledge sh\n```\n\nThe installer runs as `ledge` and puts the server, with a Bun of its own, in `/home/ledge/.ledge/.server`. It refuses to run as root, because the server belongs to the account Ledge signs in to, and `sudo -iu ledge` is how your own account runs it as that one.\n\nNothing else needs installing and no service needs starting. Ledge starts the server over ssh when it connects, and the server exits a minute after the last device leaves, unless a block is still running.\n\n## 4. Check that ssh can find it\n\nFrom your Mac, as the new account, with the new key:\n\n```sh norun\nssh -i ~/.ssh/ledge ledge@vps \'PATH=$HOME/.ledge/.server/bin:$PATH command -v ledge\'\n```\n\nA path printed means the machine is ready. This is the same lookup Ledge makes when it connects.\n\nNothing printed means the installer ran as a different account. Run step 3 again exactly as written.\n\n## 5. Add the server in Ledge\n\nRun "Notes On\u2026" from the command palette, choose Add, and fill in the form:\n\n| Field | Value |\n| --- | --- |\n| Name | Whatever you want the connection bar to say |\n| SSH destination | `ledge@vps` |\n| Port | Blank |\n| Sign in with | A key |\n| Key | `~/.ssh/ledge` |\n\nLedge fetches the machine\'s host key and shows its fingerprint. Get the same fingerprint from the machine itself, in your terminal on the VPS:\n\n```sh norun\nssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub\n```\n\nChoose "It Matches, Add" when the two agree. Ledge pins the key and refuses any future connection from that address that presents a different one.\n\n## 6. Try it\n\nThe connection bar now names the server. Press \u2318N, and the note you create is a file on the VPS. Give it one block:\n\n````\n```sh\nhostname; whoami\n```\n````\n\n\u2318\u21A9 prints the VPS\'s hostname and `ledge`. The block ran on the server, as the account you made, and the note never left it.\n\n## 7. Restrict the key to Ledge\n\nEdit `/home/ledge/.ssh/authorized_keys` on the VPS and put a prefix in front of the key:\n\n```\nrestrict,command="PATH=$HOME/.ledge/.server/bin:$PATH ledge serve" ssh-ed25519 AAAA... ledge@laptop\n```\n\nThat key can now speak Ledge\'s protocol and nothing else: no shell, no port forwarding, no file copying. sshd runs the named command whatever the client asks for, so the terminal check in step 4 stops working for this key. That is expected. Your own account is the one for terminals.\n\nThe connection you already have keeps working. Ledge\'s next connection, at the next launch or after a drop, uses the restricted line.\n\n## 8. Turn off passwords in sshd\n\nA Ledge server runs whatever its notes say, so sshd should answer keys and nothing else. Create `/etc/ssh/sshd_config.d/10-ledge.conf`:\n\n```\nPasswordAuthentication no\nKbdInteractiveAuthentication no\nPermitRootLogin prohibit-password\n```\n\nThe `10-` matters. sshd keeps the first value it reads for a setting, and it reads this directory in name order. Cloud images ship a `50-cloud-init.conf` that turns passwords on, and a file named after it would lose.\n\nYour own account has to sign in with a key from now on. The provider usually installed one when it created the VPS, and this line from your Mac says whether it did:\n\n```sh norun\nssh -o PasswordAuthentication=no you@vps true\n```\n\nIf it asks for a password, put a key on that account first, with `ssh-copy-id`.\n\nThen check the configuration and reload, keeping your current terminal open until a second one has logged in:\n\n```sh norun\nsudo sshd -t && sudo systemctl reload ssh\n```\n\n## 9. Ban repeated guesses with fail2ban\n\nKeys-only sshd refuses every guess, but a box on the public internet still receives thousands of them a day, and each one costs a log line and a connection slot. fail2ban blocks an address after a few failures.\n\n```sh norun\nsudo apt-get install -y fail2ban\n```\n\nCreate `/etc/fail2ban/jail.local`:\n\n```ini\n[sshd]\nenabled = true\nbackend = systemd\nmaxretry = 5\nbantime = 1h\n```\n\n`backend = systemd` reads sshd\'s log from the journal. Debian 12, Ubuntu 24.04, and anything newer ship without a text `auth.log`, and fail2ban without this line fails to start on them.\n\n```sh norun\nsudo systemctl enable --now fail2ban\nsudo fail2ban-client status sshd\n```\n\nThe second command prints the jail\'s counts. Ledge never trips it: it connects with a key sshd accepts, and reconnects the same way.\n\n## 10. Close every other port\n\nOnly sshd needs to be reachable. Allow it, then turn the firewall on:\n\n```sh norun\nsudo apt-get install -y ufw\nsudo ufw allow 22/tcp\nsudo ufw enable\nsudo ufw status\n```\n\nUbuntu has `ufw` already, and the install line does nothing there.\n\nIf the VPS is on a tailnet or VPN, allow ssh from that interface alone and drop the public rule:\n\n```sh norun\nsudo ufw allow in on tailscale0 to any port 22\nsudo ufw delete allow 22/tcp\n```\n\nThen use the tailnet address as the SSH destination in Ledge. A server nobody else can reach has nothing for fail2ban to do, and the previous step does no harm.\n\n## 11. Keep it patched\n\nSecurity updates for the operating system should install themselves:\n\n```sh norun\nsudo apt-get install -y unattended-upgrades\nsudo dpkg-reconfigure -plow unattended-upgrades\n```\n\nAnswer Yes. Ubuntu ships with this on, and the two commands confirm it.\n\nThe server updates with the install line from step 3, run again:\n\n```sh norun\ncurl -fsSL https://ledge.sh/server.sh | sudo -iu ledge sh\n```\n\nA connection between an app and a server that cannot understand each other is refused with a sentence naming which end to update, so a version that falls behind is reported rather than guessed at.\n\n## Where to go next\n\n- **Back it up.** The notes now live on one disk that belongs to one provider. [[Tutorial: Back Up Your Notes to S3]] puts an encrypted copy in a bucket every hour, with one `ledge backup setup`.\n- **Add your phone.** Its pairing screen hands you a line for this same `authorized_keys`, already restricted ([[Ledge on Your Phone]]).\n- **Install what your notes run.** `git`, a language, a cloud CLI: whatever a block on this machine needs, installed as your own account with `apt-get`.\n- **Reach other machines from it.** A note on the VPS can carry `host: prod`, and the VPS makes that ssh connection with a key in `/home/ledge/.ssh` ([[Run Code on Remote Hosts]]).\n';
+var _20_tutorial_set_up_a_ledge_server_default = '# Tutorial: Set Up a Ledge Server\n\nTurn a fresh Linux VPS into a Ledge server: an account for Ledge, the server package, a key that can do nothing but Ledge, and an sshd that ignores everyone else.\n\nThis builds on [[Keep Notes on a Remote Server]], which is the reference for every step here. The commands assume Debian or Ubuntu. Any Linux with glibc 2.29 or newer works, so substitute your package manager on anything else.\n\nTwo accounts appear throughout. `you@vps` is the account your provider gave you, which can `sudo`. `ledge@vps` is the account you create in step 1, which cannot.\n\n## 1. Create an account for Ledge\n\nOn the VPS, as your own account:\n\n```sh norun\nsudo adduser --disabled-password --gecos "" ledge\n```\n\nThe account has no password and no `sudo`. Everything Ledge does on this machine runs as this account: the server, the shells, and every block in every note. A key for it that is ever stolen cannot become root.\n\nIf your notes need `sudo`, that is a decision for later, made with `visudo` and as narrow as you can make it.\n\n`adduser` gives the account bash as its login shell, which is one of the two shells Ledge runs blocks in.\n\n## 2. Make a key on your computer\n\nIn a terminal on your computer:\n\n```sh norun\nssh-keygen -t ed25519 -f ~/.ssh/ledge -C ledge@laptop\ncat ~/.ssh/ledge.pub\n```\n\nLeave the key\'s passphrase empty, or use one your ssh agent already holds. Ledge\'s ssh runs with no terminal attached, so a passphrase it would have to type at a prompt never gets typed. This is about the key file only: signing in with the account\'s password is a choice on the form, and [[Keep Notes on a Remote Server]] covers it. This tutorial uses a key so that step 8 can turn passwords off.\n\nCopy the printed line, then put it on the VPS as the new account\'s only key. As your own account there, with the line pasted in place of the placeholder:\n\n```sh norun\nsudo install -d -m 700 -o ledge -g ledge /home/ledge/.ssh\necho \'ssh-ed25519 AAAA... ledge@laptop\' | sudo tee /home/ledge/.ssh/authorized_keys\nsudo chown ledge:ledge /home/ledge/.ssh/authorized_keys\nsudo chmod 600 /home/ledge/.ssh/authorized_keys\n```\n\nThe line goes in unrestricted for now. Step 7 restricts it, once you know the server works.\n\n## 3. Install the server\n\nStill on the VPS, as your own account, install the server into the new account\'s home:\n\n```sh norun\ncurl -fsSL https://ledge.sh/server.sh | sudo -iu ledge sh\n```\n\nThe installer runs as `ledge` and puts the server, with a Bun of its own, in `/home/ledge/.ledge/.server`. It refuses to run as root, because the server belongs to the account Ledge signs in to, and `sudo -iu ledge` is how your own account runs it as that one.\n\nNothing else needs installing and no service needs starting. Ledge starts the server over ssh when it connects, and the server exits a minute after the last device leaves, unless a block is still running.\n\n## 4. Check that ssh can find it\n\nFrom your computer, as the new account, with the new key:\n\n```sh norun\nssh -i ~/.ssh/ledge ledge@vps \'PATH=$HOME/.ledge/.server/bin:$PATH command -v ledge\'\n```\n\nA path printed means the machine is ready. This is the same lookup Ledge makes when it connects.\n\nNothing printed means the installer ran as a different account. Run step 3 again exactly as written.\n\n## 5. Add the server in Ledge\n\nRun "Notes On\u2026" from the command palette, choose Add, and fill in the form:\n\n| Field | Value |\n| --- | --- |\n| Name | Whatever you want the connection bar to say |\n| SSH destination | `ledge@vps` |\n| Port | Blank |\n| Sign in with | A key |\n| Key | `~/.ssh/ledge` |\n\nLedge fetches the machine\'s host key and shows its fingerprint. Get the same fingerprint from the machine itself, in your terminal on the VPS:\n\n```sh norun\nssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub\n```\n\nChoose "It Matches, Add" when the two agree. Ledge pins the key and refuses any future connection from that address that presents a different one.\n\n## 6. Try it\n\nThe connection bar now names the server. Press \u2318N, and the note you create is a file on the VPS. Give it one block:\n\n````\n```sh\nhostname; whoami\n```\n````\n\n\u2318\u21A9 prints the VPS\'s hostname and `ledge`. The block ran on the server, as the account you made, and the note never left it.\n\n## 7. Restrict the key to Ledge\n\nEdit `/home/ledge/.ssh/authorized_keys` on the VPS and put a prefix in front of the key:\n\n```\nrestrict,command="PATH=$HOME/.ledge/.server/bin:$PATH ledge serve" ssh-ed25519 AAAA... ledge@laptop\n```\n\nThat key can now speak Ledge\'s protocol and nothing else: no shell, no port forwarding, no file copying. sshd runs the named command whatever the client asks for, so the terminal check in step 4 stops working for this key. That is expected. Your own account is the one for terminals.\n\nThe connection you already have keeps working. Ledge\'s next connection, at the next launch or after a drop, uses the restricted line.\n\n## 8. Turn off passwords in sshd\n\nA Ledge server runs whatever its notes say, so sshd should answer keys and nothing else. Create `/etc/ssh/sshd_config.d/10-ledge.conf`:\n\n```\nPasswordAuthentication no\nKbdInteractiveAuthentication no\nPermitRootLogin prohibit-password\n```\n\nThe `10-` matters. sshd keeps the first value it reads for a setting, and it reads this directory in name order. Cloud images ship a `50-cloud-init.conf` that turns passwords on, and a file named after it would lose.\n\nYour own account has to sign in with a key from now on. The provider usually installed one when it created the VPS, and this line from your computer says whether it did:\n\n```sh norun\nssh -o PasswordAuthentication=no you@vps true\n```\n\nIf it asks for a password, put a key on that account first, with `ssh-copy-id`.\n\nThen check the configuration and reload, keeping your current terminal open until a second one has logged in:\n\n```sh norun\nsudo sshd -t && sudo systemctl reload ssh\n```\n\n## 9. Ban repeated guesses with fail2ban\n\nKeys-only sshd refuses every guess, but a box on the public internet still receives thousands of them a day, and each one costs a log line and a connection slot. fail2ban blocks an address after a few failures.\n\n```sh norun\nsudo apt-get install -y fail2ban\n```\n\nCreate `/etc/fail2ban/jail.local`:\n\n```ini\n[sshd]\nenabled = true\nbackend = systemd\nmaxretry = 5\nbantime = 1h\n```\n\n`backend = systemd` reads sshd\'s log from the journal. Debian 12, Ubuntu 24.04, and anything newer ship without a text `auth.log`, and fail2ban without this line fails to start on them.\n\n```sh norun\nsudo systemctl enable --now fail2ban\nsudo fail2ban-client status sshd\n```\n\nThe second command prints the jail\'s counts. Ledge never trips it: it connects with a key sshd accepts, and reconnects the same way.\n\n## 10. Close every other port\n\nOnly sshd needs to be reachable. Allow it, then turn the firewall on:\n\n```sh norun\nsudo apt-get install -y ufw\nsudo ufw allow 22/tcp\nsudo ufw enable\nsudo ufw status\n```\n\nUbuntu has `ufw` already, and the install line does nothing there.\n\nIf the VPS is on a tailnet or VPN, allow ssh from that interface alone and drop the public rule:\n\n```sh norun\nsudo ufw allow in on tailscale0 to any port 22\nsudo ufw delete allow 22/tcp\n```\n\nThen use the tailnet address as the SSH destination in Ledge. A server nobody else can reach has nothing for fail2ban to do, and the previous step does no harm.\n\n## 11. Keep it patched\n\nSecurity updates for the operating system should install themselves:\n\n```sh norun\nsudo apt-get install -y unattended-upgrades\nsudo dpkg-reconfigure -plow unattended-upgrades\n```\n\nAnswer Yes. Ubuntu ships with this on, and the two commands confirm it.\n\nThe server updates with the install line from step 3, run again:\n\n```sh norun\ncurl -fsSL https://ledge.sh/server.sh | sudo -iu ledge sh\n```\n\nA connection between an app and a server that cannot understand each other is refused with a sentence naming which end to update, so a version that falls behind is reported rather than guessed at.\n\n## Where to go next\n\n- **Back it up.** The notes now live on one disk that belongs to one provider. [[Tutorial: Back Up Your Notes to S3]] puts an encrypted copy in a bucket every hour, with one `ledge backup setup`.\n- **Add your phone.** Its pairing screen hands you a line for this same `authorized_keys`, already restricted ([[Ledge on Your Phone]]).\n- **Install what your notes run.** `git`, a language, a cloud CLI: whatever a block on this machine needs, installed as your own account with `apt-get`.\n- **Reach other machines from it.** A note on the VPS can carry `host: prod`, and the VPS makes that ssh connection with a key in `/home/ledge/.ssh` ([[Run Code on Remote Hosts]]).\n';
 
 // docs/user/21-tutorial-back-up-your-notes-to-s3.md
 var _21_tutorial_back_up_your_notes_to_s3_default = `# Tutorial: Back Up Your Notes to S3
 
 Put an encrypted copy of your notes, and everything Ledge keeps beside them, into an S3-compatible bucket, every hour, from the machine that holds them.
 
-This works the same on a Mac that runs the app and on a server set up as in [[Tutorial: Set Up a Ledge Server]]. Every command below runs on that machine, as the account Ledge runs as, and needs the \`ledge\` command on its PATH: a server has it from the install, and a Mac gets it from "Install Shell Command (ledge)" in the command palette ([[The ledge CLI]]).
+This works the same on a computer that runs the app and on a server set up as in [[Tutorial: Set Up a Ledge Server]]. Every command below runs on that machine, as the account Ledge runs as, and needs the \`ledge\` command on its PATH: a server has it from the install, and the app's computer gets it from "Install Shell Command (ledge)" in the command palette ([[The ledge CLI]]).
 
 The backup tool is restic, and \`ledge backup\` does everything around it: it fetches restic, keeps the credentials, creates the repository, computes what to back up, and keeps the schedule. restic encrypts on the machine before anything leaves it, and keeps versions, so one note from last Tuesday is something you can ask for.
 
@@ -7322,7 +7383,7 @@ The password is what encrypts the backup, and it is the only key. Nothing can be
 
 Backups run every hour while this machine's Ledge server is up, and once more before it exits.
 
-On a Mac, the server is up while the app is open and for a minute after it closes. On a VPS, it is up while a device is connected and for a minute after. Quitting the app or closing your laptop's connection is followed by a backup of whatever changed. A machine you open Ledge on after a week away backs up as soon as the server starts.
+On a computer that runs the app, the server is up while the app is open and for a minute after it closes. On a VPS, it is up while a device is connected and for a minute after. Quitting the app or closing your laptop's connection is followed by a backup of whatever changed. A machine you open Ledge on after a week away backs up as soon as the server starts.
 
 Nothing else needs installing: no timer, no unit file, no line in a crontab. One line is worth adding on a server where notes are written while no device is connected, by the \`ledge\` command or by an agent, since those do not start the server:
 
@@ -7373,7 +7434,7 @@ Do this once now, with a note you have, before you need it.
 
 ## 6. Restore everything onto a new machine
 
-On a fresh machine with Ledge installed, the app on a Mac or the server on a VPS, and the four values and the password at hand:
+On a fresh machine with Ledge installed, the app on a desktop or the server on a VPS, and the four values and the password at hand:
 
 \`\`\`sh norun
 ledge backup setup --existing
@@ -7417,7 +7478,7 @@ You publish the workspace in steps 1 to 4. Everyone else clones it in step 5, an
 
 An attached workspace is already a folder you chose, and a project workspace is usually a repository already. Either one is ready, so skip to step 2.
 
-A managed workspace lives inside \`~/.ledge\`, the app's own home. Close the workspace (\u232B on its row), move its folder in Finder to somewhere like \`~/Projects\` (\`~/.ledge\` is hidden: \u21E7\u2318G in Finder reaches it), then run "Attach Folder as Workspace\u2026" and give the folder's new path.
+A managed workspace lives inside \`~/.ledge\`, the app's own home. Close the workspace (\u232B on its row), move its folder to somewhere like \`~/Projects\` (\`~/.ledge\` is hidden: Finder's Go to Folder\u2026 reaches it, and so does Ctrl+L in GNOME Files; on Windows it is in WSL, under Linux in File Explorer), then run "Attach Folder as Workspace\u2026" and give the folder's new path.
 
 ## 2. Look at what you are about to publish
 
@@ -9727,7 +9788,7 @@ var RETIRED_DIRNAME = ".retired";
 var tmpCounter5 = 0;
 async function writePage(path, text) {
   tmpCounter5 += 1;
-  const tmp = join13(resolve9(DOCS_ROOT), `.${basename6(path)}.tmp-${process.pid}-${tmpCounter5}`);
+  const tmp = join15(resolve9(DOCS_ROOT), `.${basename6(path)}.tmp-${process.pid}-${tmpCounter5}`);
   try {
     await writeFile8(tmp, text, "utf8");
     await rename8(tmp, path);
@@ -9756,16 +9817,16 @@ async function syncDocs(pages = DOC_PAGES) {
     if (wanted.has(name))
       continue;
     try {
-      const retiredDir = join13(root, RETIRED_DIRNAME);
+      const retiredDir = join15(root, RETIRED_DIRNAME);
       await mkdir5(retiredDir, { recursive: true });
       const taken = new Set(await readdir4(retiredDir));
-      await rename8(join13(root, name), join13(retiredDir, uniqueName(name.replace(/\.md$/i, ""), taken)));
+      await rename8(join15(root, name), join15(retiredDir, uniqueName(name.replace(/\.md$/i, ""), taken)));
     } catch (err) {
       console.warn("[docs] could not retire a stale doc page", name, err);
     }
   }
   for (const [name, text] of wanted) {
-    const path = join13(root, name);
+    const path = join15(root, name);
     try {
       const current = await readFile9(path, "utf8").catch(() => null);
       if (current === text)
@@ -9778,9 +9839,9 @@ async function syncDocs(pages = DOC_PAGES) {
 }
 
 // src/bun/layout.ts
-import { basename as basename7, join as join14 } from "path";
+import { basename as basename7, join as join16 } from "path";
 import { readFile as readFile10, rename as rename9, unlink as unlink8, writeFile as writeFile9 } from "fs/promises";
-var LAYOUT_PATH = join14(APP_HOME, ".layout.json");
+var LAYOUT_PATH = join16(APP_HOME, ".layout.json");
 var ANONYMOUS = "_";
 function adoptable(parsed) {
   return typeof parsed === "object" && parsed !== null && "version" in parsed;
@@ -9808,7 +9869,7 @@ async function writeLayout(client, text) {
   const next = { ...base, [key(client)]: value };
   await ensureAppHome();
   tmpCounter6 += 1;
-  const tmp = join14(APP_HOME, `.${basename7(LAYOUT_PATH)}.tmp-${process.pid}-${tmpCounter6}`);
+  const tmp = join16(APP_HOME, `.${basename7(LAYOUT_PATH)}.tmp-${process.pid}-${tmpCounter6}`);
   try {
     await writeFile9(tmp, JSON.stringify(next), "utf8");
     await rename9(tmp, LAYOUT_PATH);
@@ -9831,10 +9892,10 @@ async function readFileJson() {
 
 // src/bun/log.ts
 import { appendFileSync, mkdirSync, renameSync, statSync } from "fs";
-import { join as join15 } from "path";
-var LOG_DIR = join15(APP_HOME, "logs");
-var LOG_PATH = join15(LOG_DIR, "ledge.log");
-var PREV_LOG_PATH = join15(LOG_DIR, "ledge.previous.log");
+import { join as join17 } from "path";
+var LOG_DIR = join17(APP_HOME, "logs");
+var LOG_PATH = join17(LOG_DIR, "ledge.log");
+var PREV_LOG_PATH = join17(LOG_DIR, "ledge.previous.log");
 var MAX_LOG_BYTES = 4 * 1024 * 1024;
 function formatArg(arg) {
   if (typeof arg === "string")
@@ -9865,8 +9926,8 @@ function sizeOf(path) {
 var logPath = LOG_PATH;
 var prevPath = PREV_LOG_PATH;
 function logToFile(basename) {
-  logPath = join15(LOG_DIR, `${basename}.log`);
-  prevPath = join15(LOG_DIR, `${basename}.previous.log`);
+  logPath = join17(LOG_DIR, `${basename}.log`);
+  prevPath = join17(LOG_DIR, `${basename}.previous.log`);
 }
 function rotate() {
   try {
@@ -9922,7 +9983,7 @@ function startLogging(basename) {
 function revealLog() {
   try {
     mkdirSync(LOG_DIR, { recursive: true });
-    Bun.spawn(["open", LOG_DIR]);
+    Bun.spawn([process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer.exe" : "xdg-open", LOG_DIR]);
     return true;
   } catch {
     return false;
@@ -10078,7 +10139,9 @@ function remoteCd(cwd) {
 }
 
 // src/bun/loginEnv.ts
+import { existsSync as existsSync3 } from "fs";
 import { homedir as homedir6 } from "os";
+import { join as join18 } from "path";
 var LOGIN_ENV_TIMEOUT_MS = 5000;
 var RESOLVING_VAR = "LEDGE_RESOLVING_ENVIRONMENT";
 var DROPPED = new Set(["PWD", "OLDPWD", "SHLVL", "_", RESOLVING_VAR]);
@@ -10159,6 +10222,28 @@ async function resolveLoginEnv(shellPath, base, opts = {}) {
   }
   return cleanLoginEnv(env);
 }
+var LOCALE_VARS = ["LC_ALL", "LC_CTYPE", "LANG"];
+var APPLE_LOCALE = /^[A-Za-z]{2,3}(_[A-Za-z0-9]{2,4})?$/;
+function withUtf8Locale(env, appleLocale, installed) {
+  if (LOCALE_VARS.some((key) => env[key]))
+    return env;
+  const region = appleLocale?.split("@")[0] ?? "";
+  const own = APPLE_LOCALE.test(region) ? `${region}.UTF-8` : null;
+  return { ...env, LANG: own && installed(own) ? own : "en_US.UTF-8" };
+}
+async function resolveUtf8Locale(env) {
+  if (process.platform !== "darwin")
+    return env;
+  if (LOCALE_VARS.some((key) => env[key]))
+    return env;
+  let appleLocale = null;
+  try {
+    const p = Bun.spawn(["defaults", "read", "-g", "AppleLocale"], { stdout: "pipe", stderr: "ignore" });
+    appleLocale = (await new Response(p.stdout).text()).trim() || null;
+    await p.exited;
+  } catch {}
+  return withUtf8Locale(env, appleLocale, (name) => existsSync3(join18("/usr/share/locale", name)));
+}
 function definedOnly(env) {
   const out = {};
   for (const [key, value] of Object.entries(env)) {
@@ -10169,7 +10254,7 @@ function definedOnly(env) {
 }
 
 // src/bun/server.ts
-import { readFileSync, statSync as statSync2 } from "fs";
+import { readFileSync as readFileSync3, statSync as statSync2 } from "fs";
 function holdRunEvent(held, ev, cap) {
   held.events.push(ev);
   if (ev.type !== "output")
@@ -10213,6 +10298,7 @@ function clientSeamRefusals() {
     windowNew: refuse("windowNew"),
     windowDocs: refuse("windowDocs"),
     windowRole: refuse("windowRole"),
+    appQuit: refuse("appQuit"),
     updateState: refuse("updateState"),
     updateCheck: refuse("updateCheck"),
     updateInstall: refuse("updateInstall"),
@@ -10249,7 +10335,10 @@ async function createServer(deps) {
   }
   await syncDocs();
   await loadVault();
-  const shellEnv = { ...await loginEnv, TERM: "xterm-256color" };
+  const shellEnv = {
+    ...await resolveUtf8Locale(await loginEnv),
+    TERM: "xterm-256color"
+  };
   const sessionParams = new Map;
   const spawnKeys = new Map;
   const sentStale = new Map;
@@ -10257,7 +10346,7 @@ async function createServer(deps) {
   const spawnDeps = {
     readFile: (path) => {
       try {
-        return readFileSync(path, "utf8");
+        return readFileSync3(path, "utf8");
       } catch {
         return null;
       }
@@ -10451,7 +10540,7 @@ async function createServer(deps) {
     } else if (ev.type === "output") {
       to.runEvent({ id: ev.blockId, kind: "output", dataB64: toB64(ev.data) });
     } else {
-      to.runEvent({ id: ev.blockId, kind: "ended", exitCode: ev.exitCode });
+      to.runEvent({ id: ev.blockId, kind: "ended", exitCode: ev.exitCode, durationMs: ev.durationMs });
     }
   }
   const deviceOf = new Map;
@@ -10959,6 +11048,7 @@ var REQUEST_METHODS = [
   "windowNew",
   "windowDocs",
   "windowRole",
+  "appQuit",
   "settingsGet",
   "settingsRead",
   "settingsWrite",
@@ -11020,6 +11110,7 @@ var NATIVE_METHODS = [
   "windowNew",
   "windowDocs",
   "windowRole",
+  "appQuit",
   "updateState",
   "updateCheck",
   "updateInstall"
@@ -11094,12 +11185,24 @@ function replace(payload, path, value) {
   copy[head] = rest.length === 0 ? value : replace(copy[head], rest, value);
   return copy;
 }
-function toBase64(bytes) {
-  return bytes.toBase64();
+var nativeBase64 = typeof Uint8Array.prototype.toBase64 === "function";
+var CHUNK = 32768;
+function toBase64Slow(bytes) {
+  let text = "";
+  for (let at = 0;at < bytes.length; at += CHUNK) {
+    text += String.fromCharCode(...bytes.subarray(at, at + CHUNK));
+  }
+  return btoa(text);
 }
-function fromBase64(text) {
-  return Uint8Array.fromBase64(text);
+function fromBase64Slow(text) {
+  const raw = atob(text);
+  const bytes = new Uint8Array(raw.length);
+  for (let i = 0;i < raw.length; i++)
+    bytes[i] = raw.charCodeAt(i);
+  return bytes;
 }
+var toBase64 = nativeBase64 ? (bytes) => bytes.toBase64() : toBase64Slow;
+var fromBase64 = nativeBase64 ? (text) => Uint8Array.fromBase64(text) : fromBase64Slow;
 function hello(role, build, client = "", instance = "", hold = 0, label = "", device = "") {
   const serves = role === "server";
   return {
@@ -11764,11 +11867,11 @@ function createOpLog(opts) {
 }
 
 // src/shared/version.ts
-var BUILD_VERSION = "0.1.1";
+var BUILD_VERSION = "0.1.3";
 
 // src/bun/daemon.ts
-var SOCKET_PATH = join16(APP_HOME, ".server.sock");
-var PID_PATH = join16(APP_HOME, ".server.pid");
+var SOCKET_PATH = join19(APP_HOME, ".server.sock");
+var PID_PATH = join19(APP_HOME, ".server.pid");
 var DAEMON_LOG = "ledge-server";
 var IDLE_EXIT_MS = 60000;
 var IDLE_EXIT_NEVER = 0;
@@ -12012,13 +12115,13 @@ function spawnDaemon(head = ownCommand()) {
   let errFd = "ignore";
   try {
     mkdirSync2(LOG_DIR, { recursive: true });
-    errFd = openSync(join16(LOG_DIR, `${DAEMON_LOG}.log`), "a");
+    errFd = openSync(join19(LOG_DIR, `${DAEMON_LOG}.log`), "a");
   } catch {}
   Bun.spawn({ cmd: argv, stdin: "ignore", stdout: "ignore", stderr: errFd }).unref();
 }
 function daemonPid(pidPath = PID_PATH) {
   try {
-    const pid = Number(readFileSync2(pidPath, "utf8").trim());
+    const pid = Number(readFileSync4(pidPath, "utf8").trim());
     return Number.isInteger(pid) && pid > 1 ? pid : null;
   } catch {
     return null;
@@ -12028,7 +12131,7 @@ function daemonPid(pidPath = PID_PATH) {
 // src/bun/backupCli.ts
 import { randomBytes as randomBytes2 } from "crypto";
 import { homedir as homedir8 } from "os";
-import { join as join19 } from "path";
+import { join as join22 } from "path";
 
 // src/bun/ask.ts
 var reader = null;
@@ -12090,7 +12193,7 @@ async function ask(question, o = {}) {
 }
 
 // src/bun/backup.ts
-import { join as join17 } from "path";
+import { join as join20 } from "path";
 function backupSet(input) {
   const { appHome, profilesDir, roots, secrets } = input;
   const include = [appHome];
@@ -12102,7 +12205,7 @@ function backupSet(input) {
   return { include: unique(include), exclude: excludesFor(appHome) };
 }
 function excludesFor(appHome) {
-  return [".server.sock", ".server.pid", "logs", ".ledge-docs", ".server"].map((name) => join17(appHome, name));
+  return [".server.sock", ".server.pid", "logs", ".ledge-docs", ".server"].map((name) => join20(appHome, name));
 }
 function unique(paths) {
   return [...new Set(paths)];
@@ -12353,18 +12456,18 @@ function duration(ms) {
 }
 
 // src/bun/backupRun.ts
-import { chmodSync as chmodSync2, existsSync as existsSync2, mkdirSync as mkdirSync3, openSync as openSync2, closeSync, readFileSync as readFileSync3, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync4, mkdirSync as mkdirSync3, openSync as openSync2, closeSync, readFileSync as readFileSync5, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "fs";
 import { mkdtemp, rm as rm2 } from "fs/promises";
-import { join as join18 } from "path";
-var BACKUP_DIR = join18(APP_HOME, ".server", "backup");
-var STATE_PATH = join18(BACKUP_DIR, "state.json");
-var LOCK_PATH = join18(BACKUP_DIR, "lock");
-var RESTIC_CACHE_DIR = join18(BACKUP_DIR, "cache");
-var PROFILE_PATH = join18(PROFILES_DIR, `${BACKUP_PROFILE}.env`);
+import { join as join21 } from "path";
+var BACKUP_DIR = join21(APP_HOME, ".server", "backup");
+var STATE_PATH = join21(BACKUP_DIR, "state.json");
+var LOCK_PATH = join21(BACKUP_DIR, "lock");
+var RESTIC_CACHE_DIR = join21(BACKUP_DIR, "cache");
+var PROFILE_PATH = join21(PROFILES_DIR, `${BACKUP_PROFILE}.env`);
 function readConfig() {
   let text = null;
   try {
-    text = readFileSync3(PROFILE_PATH, "utf8");
+    text = readFileSync5(PROFILE_PATH, "utf8");
   } catch {}
   return parseBackupConfig(text);
 }
@@ -12382,7 +12485,7 @@ function resticEnv(config) {
   return env;
 }
 function fetchedResticPath(version = RESTIC_VERSION) {
-  return join18(BACKUP_DIR, `restic-${version}`);
+  return join21(BACKUP_DIR, `restic-${version}`);
 }
 async function findRestic(opts = {}) {
   const onPath = Bun.which("restic", { PATH: process.env["PATH"] ?? "" });
@@ -12393,7 +12496,7 @@ async function findRestic(opts = {}) {
     opts.log?.(`[backup] ${onPath} is restic ${version ?? "of an unknown version"}; ${RESTIC_MIN_VERSION} or newer is needed`);
   }
   const fetched = fetchedResticPath();
-  if (existsSync2(fetched)) {
+  if (existsSync4(fetched)) {
     const version = await versionOf(fetched);
     if (version)
       return { path: fetched, version };
@@ -12473,7 +12576,7 @@ function resticSaid(r) {
 }
 function readState() {
   try {
-    return parseState(readFileSync3(STATE_PATH, "utf8"));
+    return parseState(readFileSync5(STATE_PATH, "utf8"));
   } catch {
     return parseState(null);
   }
@@ -12496,7 +12599,7 @@ async function withBackupLock(fn) {
     } catch (err) {
       if (err.code !== "EEXIST")
         throw err;
-      const holder = Number(readFileSync3(LOCK_PATH, "utf8").trim());
+      const holder = Number(readFileSync5(LOCK_PATH, "utf8").trim());
       if (Number.isInteger(holder) && holder > 0 && alive(holder))
         return { busy: holder };
       try {
@@ -12526,7 +12629,7 @@ function rootsOnDisk() {
   const present = [];
   const skipped = [];
   for (const r of roots())
-    (existsSync2(r) ? present : skipped).push(r);
+    (existsSync4(r) ? present : skipped).push(r);
   return { present, skipped };
 }
 async function runBackup(o = { reason: "now" }) {
@@ -12544,9 +12647,9 @@ async function runBackup(o = { reason: "now" }) {
     for (const r of skipped)
       log(`[backup] skipping ${r}: not on disk (unmounted volume?)`);
     const set = backupSet({ appHome: APP_HOME, profilesDir: PROFILES_DIR, roots: present, secrets: o.secrets ?? true });
-    const dir = await mkdtemp(join18(BACKUP_DIR, "run-"));
-    const filesFrom = join18(dir, "include");
-    const excludeFile = join18(dir, "exclude");
+    const dir = await mkdtemp(join21(BACKUP_DIR, "run-"));
+    const filesFrom = join21(dir, "include");
+    const excludeFile = join21(dir, "exclude");
     try {
       writeFileSync3(filesFrom, `${set.include.join(`
 `)}
@@ -12932,7 +13035,7 @@ async function restore(args) {
   const to = valueOf(args, "--to");
   if (inPlace && to)
     return usage("--in-place restores to the original paths; --to names another folder. One or the other.");
-  const target = inPlace ? "/" : to ?? join19(homedir8(), `ledge-restore-${stamp(new Date)}`);
+  const target = inPlace ? "/" : to ?? join22(homedir8(), `ledge-restore-${stamp(new Date)}`);
   const include = args.filter((a, i) => !a.startsWith("--") && args[i - 1] !== "--snapshot" && args[i - 1] !== "--to");
   if (inPlace && daemonRunning()) {
     say(`This machine's Ledge server is running, and an in-place restore writes under it. Quit Ledge, or stop the daemon (kill $(cat ${PID_PATH})), and run this again.`);
@@ -13918,9 +14021,9 @@ function pairCode(user, address, keys) {
 }
 
 // src/bun/serve.ts
-import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
 import { hostname, networkInterfaces, userInfo } from "os";
-import { join as join20 } from "path";
+import { join as join23 } from "path";
 async function serve2() {
   const upstream = await connectToDaemon();
   const mine = stdioDuplex();
@@ -13971,7 +14074,7 @@ async function pair(argv) {
   if ("error" in args)
     return fail(`${args.error}
 ${PAIR_USAGE}`, 2);
-  if (existsSync3("/.dockerenv") || existsSync3("/run/.containerenv")) {
+  if (existsSync5("/.dockerenv") || existsSync5("/run/.containerenv")) {
     const refusal = containerRefusal(args);
     if (refusal)
       return fail(refusal);
@@ -13993,15 +14096,15 @@ ${PAIR_USAGE}`, 2);
     keyText = await Bun.stdin.text();
   else if (args.keys !== undefined) {
     try {
-      keyText = readFileSync4(args.keys, "utf8");
+      keyText = readFileSync6(args.keys, "utf8");
     } catch {
       return fail(`Could not read ${args.keys}.`);
     }
   } else {
-    const files = existsSync3(HOST_KEY_DIR) ? readdirSync(HOST_KEY_DIR).filter((f) => /^ssh_host_\w+_key\.pub$/.test(f)) : [];
+    const files = existsSync5(HOST_KEY_DIR) ? readdirSync2(HOST_KEY_DIR).filter((f) => /^ssh_host_\w+_key\.pub$/.test(f)) : [];
     for (const file of files) {
       try {
-        keyText += `${readFileSync4(join20(HOST_KEY_DIR, file), "utf8")}
+        keyText += `${readFileSync6(join23(HOST_KEY_DIR, file), "utf8")}
 `;
       } catch {}
     }
@@ -14048,13 +14151,13 @@ function dmi() {
   const out = {};
   for (const field of DMI_FIELDS) {
     try {
-      out[field] = readFileSync4(join20(DMI_DIR, field), "utf8");
+      out[field] = readFileSync6(join23(DMI_DIR, field), "utf8");
     } catch {}
   }
   return out;
 }
 async function tailnetSelf() {
-  const path = TAILSCALE_PATHS.find((p) => existsSync3(p));
+  const path = TAILSCALE_PATHS.find((p) => existsSync5(p));
   if (!path)
     return null;
   try {